DoD Paused CMMC Phase 2. Your Subcontract Flow-Down Didn't.

Every piece of coverage on the CMMC Phase 2 suspension has been written from the government's side of the contract, and that is the blind spot worth naming this week: the Department of War can pause a federal clause in an afternoon, and a prime can leave the identical requirement sitting untouched in your subcontract for months, because the two documents have never been the same instrument. If you're a subcontractor reading the pause as relief, check the paper you actually signed before you stand down anything.

The Department of War suspended CMMC Phase 2 requirements in mid-July and opened a 60-day reform review — the certification gate created by DFARS 252.204-7021, which conditions contract award on a C3PAO-verified score. DFARS 252.204-7012, the clause that has required safeguarding covered defense information to the NIST SP 800-171 standard since 2017, did not pause; neither did the duty to keep an honest self-assessment score in SPRS or report an incident within 72 hours of discovery. We covered that federal-clause distinction in detail in a companion piece last week. This piece starts where that one stopped: at the boundary between the federal clause and the private contract sitting on top of it.

A subcontractor almost never contracts directly with the government. You contract with a prime, and the prime's subcontract is the document that actually binds you — DFARS 252.204-7021 reaches you only because the prime's contracting officer flowed it down, and the mechanism of that flow-down is ordinary contract language the prime's legal department wrote, not a live mirror of whatever DFARS currently says. When the government suspends a clause in the prime contract, the prime's obligation to enforce it against you changes immediately. Your subcontract's obligation to comply with it changes only when your prime amends the subcontract — and nothing about this month's suspension requires them to do that on any particular timeline, or at all, during a 60-day review whose outcome nobody can predict yet.

Pull your actual subcontract text before you assume either one:

• Dynamically tied. Some subcontracts flow down CMMC by reference — "Subcontractor shall comply with DFARS 252.204-7021 as it applies to the prime contract" — language that rides the federal clause's status automatically. If your subcontract reads this way, the suspension arguably reaches you the moment it reaches your prime.
• Fixed as a delivery condition. Many subcontracts instead write CMMC in as a standalone requirement — "Subcontractor shall maintain a current CMMC Level 2 certification by [date]" — a specific, independently negotiated condition of the subcontract itself. That language doesn't reference DFARS at all in its operative sentence, so a DFARS suspension doesn't touch it. It survives until your prime formally modifies the subcontract, full stop.

Prime compliance offices write conservatively for good reason — they carry the liability if a sub's posture is wrong on a flow-down audit — and a fixed condition is easier to enforce than a reference that has to be re-checked against DFARS's current text every time someone asks. That means the fixed pattern is common, and it means a lot of subs are still contractually on the hook for a certification the federal government currently isn't requiring of anyone.

• Read the actual clause, not the news. Pull your subcontract's CMMC language and classify it as dynamic or fixed before you change any budget, staffing, or assessment-prep decision.
• Ask your prime's contracts office for it in writing. A blog post or all-hands email saying "CMMC is paused" is not a subcontract modification. If you want relief, get a written amendment or a contracting-officer confirmation that names your subcontract number.
• Assume "fixed" until told otherwise. If your subcontract language is ambiguous or you haven't reviewed it recently, the safer default is to keep building toward the certification date already in the document — reversing course later costs less than explaining a missed contractual deadline to a prime who never actually excused it.
• Keep the 7012 baseline moving regardless. Whatever your flow-down clause says about certification, NIST SP 800-171 safeguarding and 72-hour incident reporting are federal obligations that didn't pause for anyone in the supply chain — your CMMC Level 2 program work stays relevant either way.

This is not legal advice, and we have not reviewed your subcontract or anyone else's — flow-down language varies by prime, by program, and sometimes by task order within the same prime. We don't know whether any specific prime intends to modify subcontracts during the review window, and nothing here should be read as a prediction that they will or won't. If your subcontract's CMMC language is unclear, that's a question for your prime's contracts office and your own counsel, not a newsletter.

The subs who come out of this review period ahead are the ones who treated "the federal clause paused" and "my subcontract changed" as two separate questions requiring two separate answers, instead of assuming the second follows automatically from the first. If you want a second set of eyes on what your subcontract actually requires while the federal picture is still in flux, start a readiness conversation or talk to us — we'll help you read the clause you signed, not just the clause that made news. ◆