Your Raytheon Contract Says You Need CMMC. Here’s What That Actually Means Now.

A clause appears in a subcontract. It references CMMC, or DFARS 252.204-7012, or both. Somebody forwards it to you with a question mark.

Here is what it means, as of right now, which is different from what it meant three months ago.

The certification requirement is suspended. On September 3, 2026 the Department of War signed a class deviation that made the earlier Phase 2 suspension binding regulation rather than policy. Mandatory third party assessment is off the table through November 2028. Contracting officers have been instructed to strip those requirements out of contracts. If your prime is still telling you that you need a certificate by November 10, they are working from old information.

Everything underneath it still applies. DFARS 252.204-7012 was not touched. All 110 NIST SP 800-171 controls remain in force. If your contract has the 7012 clause and you handle controlled unclassified information, your obligations are exactly what they were in June.

What changed is who checks. Levels 1 and 2 can now be met by self assessment. You post your own score to the Supplier Performance Risk System and you attest to it.

Why that is not the relief it sounds like

Three things did not go away.

The Defense Contract Management Agency can still assess any covered system at any time, and its result overrides whatever you posted. Self attesting does not make your number final.

Your prime can still audit you. That right comes from your subcontract, not from the regulation, and it never depended on CMMC. Primes police their supply chain because their own exposure runs through it.

And the number you post is now a statement you made to the federal government to win work. In June 2026 a defense contractor in Huntsville paid $507,144 to settle False Claims Act allegations over cybersecurity requirements. Department of Justice recoveries in cybersecurity cases have more than tripled in each of the last two years. The cases are usually brought by employees, not discovered by auditors.

What to actually do about the clause

Read it for the 7012 obligation rather than the CMMC label. Ask your prime, in writing, what they expect and by when, because their internal policy may be stricter than the current regulation and that is their right.

Then find out what your real SPRS score is, as opposed to what is posted. That is the number that matters and it is the one most likely to be wrong.