The Contractor Floor

Seat change: contractor

Final seat, as declared in Lesson 1.1. The military installation in Meridian’s interconnect story does what military installations do to their suppliers: it puts contract clauses into Meridian’s world. Somewhere in the contract stack sits the DFARS safeguarding clause (DFARS — the Defense Federal Acquisition Regulation Supplement, the DoD’s add-on to the federal contracting rulebook), and with it a set of obligations that exist independently of every certification program, framework rewrite, and policy headline in this module. This lesson is the one most likely to prevent a real harm, because 2026’s loudest compliance headline is precisely engineered to be misread.

The headline and the floor

The headline: the DIB’s certification program (CMMC) suspended its rollout phase in mid-2026. The capacity arithmetic finally arrived (Lesson 1.3’s constraint, in its bluntest form yet): a defense industrial base of roughly a hundred thousand companies against a certification-assessor ecosystem numbered in the low hundreds. The math didn’t math, a reform task force convened, and phase-two enforcement stopped.

The misreading, already circulating in vendor channels: “CMMC is dead, CUI compliance is paused.” (CUI — Controlled Unclassified Information: information the government requires to be protected even though it is not classified; CMMC — the Cybersecurity Maturity Model Certification, the DoD’s program for certifying that contractors protect it.) Now the correction that pays for this training. What binds a contractor holding CUI was never the certification program — it’s the clause stack underneath it, and every layer of it is fully alive:

THE FLOOR - in force today, no certification program required:

  DFARS 252.204-7012   the safeguarding clause in the contract itself:
                       implement the CUI control set, report incidents
                       on the clock, flow the clause DOWN to subs

  NIST 800-171 R2      the control set that clause invokes - note R2:
                       contracts cite R2 even though R3 published in
                       2024 (Lesson 1.2's currency trap, resolved by
                       reading YOUR contract, not the NIST site)

  SPRS                 (the Supplier Performance Risk System - the DoD
                       database where your score is on record; via 7012's
                       companion clauses 252.204-7019/-7020)
                       your self-assessment SCORE, submitted to the
                       supplier-risk system - a number, on the record,
                       false statements carrying False Claims exposure

Paused certification is not paused compliance. The certification program was a verification layer on top of obligations that predate it and survive it. (One contracts-not-headlines caveat: if a contract you already hold incorporates the CMMC clause, 252.204-7021, a program-level suspension does not edit your contract — what that clause now requires of you is a question for your contracting officer, answered in writing, not a question the news answers.) Suspending the verifier does not suspend the obligation — it returns verification to self-assessment-plus-enforcement, where the False Claims Act has already produced settlements against contractors whose SPRS scores wrote checks their networks couldn’t cash. And here Lesson 1.1’s anchor completes its arc: certification was never risk acceptance, and it was never the obligation either — a CMMC certificate was always evidence about the floor, not the floor. Teams that understood that never stumbled on the headline.

The direction of acquisition rules

Two currents to track calmly, both fenced below: software attestation went risk-based — the government-wide direction replaced blanket attestation collection with agency-owned, risk-based assurance (attestation optional as a tool, SBOM-on-request in the kit — your Lesson 4.2 SBOM machinery answering acquisition questions now, not just platform ones). And CUI clauses are consolidating into the FAR — the civilian acquisition rulebook is absorbing a rewritten CUI regime (tight incident-reporting clocks, consolidated do-not-buy lists) that will eventually sit alongside the DFARS layer. Direction for both: obligations are moving into contract text and structured evidence, away from certificate ceremonies. Which is this training’s whole thesis wearing an acquisition badge: the floor is the contract plus the control set plus honest evidence — build for that and the program churn above it becomes weather.

Prompt first: the clause-stack audit

Read our contracts directory (and flowdowns received from primes).
GROUND RULE: you extract CANDIDATE obligations and quote the clause text;
counsel or the contracting officer determines what each one means - flag,
never conclude.
Build the clause-stack audit:
1) every safeguarding/CUI clause present - by number, with the control
   set and REVISION it invokes (do not assume; quote the text);
2) our SPRS posture: score on record, date, and the delta between
   what we attested and what our current 800-171 self-assessment
   would score TODAY - flag every control where the gap runs in the
   dangerous direction;
3) flowdown health: which subs received the clause from us, which
   returned evidence, which are silent;
4) incident-reporting readiness: the clock the clause starts, who is
   on call to meet it, and whether they know it.
Output: a floor-status one-pager for leadership, honest column first -
and one scoping question on its own line: is CUI confined to a defined
enclave (the standard commercial move that shrinks the 800-171 footprint
to the systems that actually touch it), or is the whole estate in scope?

Practice status — among mature regulated delivery programs, commercial and federal

(a few rows carry a more specific status - principle, canon, suspended - where one of the five would mislead)

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

The contractor floor is the clause stack, not the certificate: the DFARS safeguarding clause, the 800-171 R2 control set it invokes (read your contract, not the headline), and an SPRS score that is accurate on the day it’s on the record. Paused certification is not paused compliance — suspending the verifier never suspended the obligation, and the anchor pattern closes its arc: certification was never the floor, only evidence about it. Track the risk-based, into-the-contract direction of acquisition rules; audit your clause stack and your flowdowns before someone else does. Module 4 complete — next, the software crosses the boundary.

LEADERSHIP DECISION   treat the clause stack as a standing obligation with a
                      named owner - and never let a certification headline
                      change what gets funded
PRACTITIONER ACTION   run the clause-stack audit with counsel in the loop;
                      keep SPRS accurate on the day it is on record; enforce
                      flowdowns; scope CUI to an enclave where you can
SUCCESS MEASURE       zero gap between the SPRS score on record and a current
                      self-assessment; every sub has returned flowdown
                      evidence; incident clock rehearsed