FAR & DFARS: Procurement Power

This episode analyzes Class Deviation 2026-O0025 Revision 3, exploring consolidated security requirements under FAR Part 40 and DFARS Part 240 along with the two-year delay of the CMMC Phase 2 transition to November 2028. It also examines the implications of continued NIST SP 800-171 enforcement, mandatory flowdown considerations, SPRS False Claims Act risks, and new data security prohibitions on DoD personnel information.

We analyze Class Deviation 2026-O0025 Revision 3, exploring how it operationalizes FAR Part 40 and DFARS Part 240 while altering CMMC Phase 2 timelines. The discussion details key compliance requirements, from mandatory employee data flowdowns to statutory procurement bans on certain semiconductors and unmanned aircraft systems.

Learn how the consolidation of security clauses into FAR Part 40, updated CUI requirements, and Class Deviation changes impact federal contractors. We also explore the NIST SP 800-171 revision split between civilian and defense contracts, mandatory flowdowns, and the latest status of CMMC Phase 2.

We unpack FAR and DFARS information-security changes, including revised clause numbering, SPRS assessments, mandatory flowdowns, class deviations, and what the CMMC Phase 2 suspension does—and does not—change. Learn why contract modifications matter, which security duties remain in force, and what contractors should verify in their contract files.

Show Notes

• CMMC Phase 2 Suspension: Class Deviation Revision 3 Explained: https://serabrynn.com/resources/cmmc-phase-2-suspension-class-deviation-revision-3/

Discover how the new DFARS Part 240 and Class Deviation 2026-O0025 reshape cybersecurity flowdowns for defense subcontractors. Learn how to separate mandatory statutory clauses from data-dependent requirements to push back against prime contractor over-compliance.

Defense cyber rules shifted again as CMMC Phase 2 was suspended, keeping the safeguarding baseline in place while pausing third-party certification at Level 2. The episode also breaks down new DFARS flowdowns on DoD employee data, foreign-made drones, semiconductor restrictions, and how to tell statute-driven obligations from data-triggered cyber clauses.

This episode breaks down the latest federal cybersecurity rule changes for contractors, from the shift to NIST SP 800-171 Revision 3 in civilian contracts to CMMC Level 2’s continued use of Revision 2 in defense work. It also covers the end of basic assessments, new breach reporting rules, key subcontractor flowdown issues, and the new form agencies must use to define CUI scope before demanding costly controls.

Show Notes

• [PDF] Class Deviation 2026-O0025, “Revolutionary Federal Acquisition ...: https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_TAB_A_Deviation_Memo_DFARS_240.pdf

Defense contractors are facing a major shift as the DoD replaces self-reported SPRS scores with government-led validation assessments under new DFARS Part 240 rules. The episode also covers supply chain exclusion authority, unreviewable risk decisions, rapid incident reporting, and the urgency of updating subcontract flowdowns.

Show Notes

• [PDF] MEMORANDUM FOR - acq.osd.mil: https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_TAB_A_Deviation_Memo_DFARS_240.pdf

This episode breaks down Class Deviation 2026-O0025 and its impact on DFARS cybersecurity flowdowns, subcontractor obligations, and incident reporting across the defense supply chain. It also covers CMMC assessment non-duplication rules and the government’s expanded authority to remove risky vendors from covered programs.

Defense contractors are facing a major DFARS renumbering that turns old cybersecurity citations into a compliance hazard, especially when primes accidentally flow down retired clauses to subcontractors. The episode also breaks down how the new rule shifts verification away from basic self-attestation and toward government-led assessments that demand real evidence, not paper promises.