CMMC Phase 2 C3PAO assessments are suspended. Your NIST 800-171 and SPRS obligations are not. Read the plain-English breakdown →
A CMMC exemption is a real thing, and a much narrower thing than most contractors hope. This article covers the exemptions that actually exist, then works through the four arguments contractors make…
Learn moreFinding a DFARS clause in an already signed contract is one of the more uncomfortable discoveries in government contracting, and it is far more common than anyone admits. Somebody runs a search,…
Learn moreFAR 52.204-21 is the clause most contractors assume doesn’t apply to them, and most of them are wrong. It applies to nearly every company holding a federal contract, it predates CMMC,…
Learn moreDFARS flowdown requirements are where most real compliance exposure sits, and where the fewest contractors have a defensible position. The obligation runs both directions — you inherit requirements from your prime…
Learn moreDFARS flowdown requirements are where most real compliance exposure sits, and where the fewest contractors have a defensible position. The obligation runs both directions — you inherit requirements from your prime…
Learn moreFAR 52.204-21 is the clause most contractors assume doesn’t apply to them, and most of them are wrong. It applies to nearly every company holding a federal contract, it predates CMMC,…
Learn moreDFARS 252.204-7019, 7020 and 7021 arrived together, sit next to each other in solicitations, and get treated as one requirement. They aren’t. They do three different jobs, they bind different…
Learn moreDFARS 252.204-7012 is the clause that turns a defense contract into a cybersecurity obligation. It has been in contracts since 2016, it survived the CMMC Phase 2 suspension untouched, and it…
Learn moreThe DFARS cybersecurity clauses show up in defense contracts in a predictable way: someone in contracts forwards a solicitation with a highlighted paragraph and asks whether it’s a problem. This pillar explains…
Learn more