DFARS 252.204-7012 Explained: What "Running 7012" Actually Means
A prime tells you to "run 7012." Here is what the clause actually requires: NIST 800-171, 72-hour incident reporting, a 90-day media hold, and flow-down to your subs.
CMMC Phase 2 Is Suspended — What Actually Changed, and What Didn't. Plus 15 Vetted Contracts
On July 13 the Department of War froze CMMC third-party assessments and launched a 60-day review — but self-assessment, DFARS 7012, and your SPRS affirmation still bind you. What to do now, plus 15 vetted opportunities in a week the government kept buying cyber: Army ICAM, a SIEM set-aside, PKI, and more.
The FAR CUI Rule: NIST 800-171 Rev 3 Comes to Civilian Contracts
The FAR would extend CUI safeguarding to civilian contractors at NIST 800-171 Rev 3, not the Rev 2 DoD requires. What the proposed rule changes, and when.
Rev 3 Is Coming to CMMC — and the Interim Rule Is Due This Month. Plus 15 Vetted Contracts
The Unified Agenda shows DoD adopting an interim final rule this month to move CMMC from NIST 800-171 Rev 2 to Rev 3 — and it takes effect on publication. Here's what changes and how to prepare. Plus 15 vetted opportunities, including two rare small-business set-asides on classified Air Force infrastructure.
The Unified Agenda shows DoD adopting an interim final rule in July that sets the transition from NIST SP 800-171 Rev 2 to Rev 3. Interim final rules take effect on publication.
The FAR Just Rewrote Civilian CUI Rules. You Have Until July 23 — Plus 15 Vetted Contracts
The FAR Council folded civilian CUI rules into Part 40: NIST 800-171 Rev 3, 72-hour incident reporting, one standard form. Comments close July 23. Plus 15 vetted opportunities — including DOJ's managed-attribution buy and an Interior Cisco IDIQ set aside for small business.
