Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
CMMC is not a one-time certificate. It is a status you must hold at several points in a DoW contract's life: when you bid, before award, every year you perform, and before each option period. The DFARS clauses that drive this are 252.204-7025 in the solicitation and 252.204-7021 in the contract, with 252.204-7012 underneath both. For contractors managing SPRS in Honolulu and across Hawaii, knowing where each DFARS requirement shows up is the difference between a smooth award and a lost one. This guide walks through the lifecycle in order, including what changed with the July 2026 pause.
The Three DFARS Clauses Behind CMMC
Three clauses do most of the work:
- DFARS 252.204-7012 requires contractors handling CUI to implement all 110 NIST SP 800-171 requirements, report cyber incidents within 72 hours through the DoD Cyber Crime Center (DC3) reporting portal, preserve images for 90 days, submit malware to DC3, and use FedRAMP Moderate or equivalent cloud services for CUI. It has applied since December 31, 2017.
- DFARS 252.204-7025 is the solicitation provision added by the DFARS CMMC rule, effective November 10, 2025. It tells offerors which CMMC level and assessment type the contract will require.
- DFARS 252.204-7021 is the contract clause. It requires you to maintain CMMC status for each information system, identified by CMMC Unique Identifiers (UIDs) in SPRS. It also covers affirmations, flow-down to subcontractors, and reporting UID changes to the contracting officer.
The February 1, 2026 DFARS overhaul moved cyber rules from Part 204 to Part 240 and renumbered or removed some older clauses. 7012, 7021, and 7025 kept their numbers.
Stage 1: The Solicitation
The first place CMMC appears is the solicitation. Look for 252.204-7025 and the required level:
- Level 1 (self): for contracts involving only Federal Contract Information (FCI). 15 requirements from FAR 52.204-21, now renumbered FAR 52.240-93 with the same requirements.
- Level 2 (self): for CUI where the contract allows a self-assessment.
- Level 2 (C3PAO): for CUI where the contract requires third-party certification.
- Level 3 (DIBCAC): for the most sensitive programs. Requires a Level 2 C3PAO certification first, then a government assessment of 24 additional requirements from NIST SP 800-172.
Read the solicitation before you decide to bid. If it requires a level you do not hold, you will not be able to get there during a typical response window.
Stage 2: Before Award
Your CMMC status must be current in SPRS before award. The contracting officer checks it. This is where many small contractors get caught, for two reasons.
First, access. Many contractors do not have working SPRS and PIEE accounts. Getting access can take days to weeks. Checking that access is one of the first steps we take with contractors who contact us about CMMC Honolulu support.
Second, the status itself. Status is tied to specific information systems through CMMC UIDs. If the system that will handle the contract's FCI or CUI does not have a current status and affirmation, the status is not current for that contract.
Correcting a Common Myth: You Cannot Bid Your Way Around Gaps With a POA&M
An earlier version of this post said companies not fully compliant could still bid on less sensitive contracts if they provided a Plan of Action and Milestones. That was wrong, and I want to correct it plainly.
- Level 1 does not allow a POA&M. All 15 requirements must be met. There is no partial credit.
- Level 2 allows conditional status only in narrow cases. You need at least 88 of 110 points. Generally, only 1-point requirements may be on the POA&M, plus a narrow exception for 3.13.11 when encryption is used but not FIPS validated. Six requirements can never be on a POA&M, including the System Security Plan (3.12.4).
- POA&M items must close within 180 days, confirmed by a closeout assessment. If they do not, conditional status expires.
A POA&M is a short bridge to final status. It is not a way to bid while noncompliant.
Stage 3: Flow-Down to Subcontractors
If you are a prime, the rule requires you to confirm each subcontractor's CMMC status before awarding a subcontract. The requirement follows the information:
- A sub that handles only FCI needs at least Level 1.
- A sub that handles CUI needs at least the same Level 2 assessment type the prime contract requires, self or C3PAO.
- A sub under a Level 3 prime needs at least Level 2 (C3PAO).
Many primes are still working out how they will flow this down. Until they do, my advice to subcontractors is to match the level of the DoW contract. A prime's requirement is a private agreement, so it applies even when the DoW is not enforcing a phase. Our page on building a supplier base that can hold the contract covers the prime side.
Stage 4: Performance and Annual Affirmations
During performance, you must keep your status current. That means:
- Level 1: an annual self-assessment and an annual affirmation in SPRS.
- Level 2: a new assessment every three years, with an affirmation after each assessment and annually after that.
- Changes: if a CMMC UID changes, for example because you moved CUI to a new environment, you report it to the contracting officer.
- Incidents: 72-hour reporting under DFARS 7012 continues throughout.
An affirmation is a signed statement by a senior official that you continue to meet the requirements. It is the document most likely to matter in a False Claims Act case. In June 2026, LOGZONE settled for $507,144 after reporting an SPRS score of 110 that DIBCAC found to be -170.
Stage 5: Option Periods and Modifications
The contracting officer must confirm current CMMC status before exercising an option period. Many Hawaii contractors live on multi-year contracts with annual options. Each option date is a CMMC checkpoint.
Option periods also matter for the pause. Under Class Deviation 2026-O0025 Revision 3, issued September 3, 2026, a C3PAO requirement already in a contract is removed at the next option or modification. Contracting officers now accept a Level 1 or Level 2 self-assessment in place of a C3PAO assessment.
How the 2026 Pause Fits Into the Lifecycle
On July 13, 2026, the DoW suspended Phase 2, which would have made Level 2 C3PAO certification mandatory in applicable solicitations starting November 10, 2026. A CMMC Reform Task Force began a 60-day review. At the time of this update, its report has not been published.
What the pause did not change: 7012, 7021, 7025, SPRS affirmations, DIBCAC assessment authority, the False Claims Act, and your primes' requirements. Each lifecycle step above still applies. Only the assessment type accepted at award has changed.
SPRS in Honolulu: A Lifecycle Checklist for Contractors
- Get SPRS and PIEE access for at least two people.
- Identify every information system that handles FCI or CUI and its CMMC UID.
- Read each solicitation for 7025 and the required level before deciding to bid.
- Confirm status is current in SPRS before award.
- Calendar every annual affirmation and every option exercise date.
- Confirm each subcontractor's status before you award to them.
- Keep your SSP current so every affirmation is defensible.
Talk to Intech Pacific About Your Contracts
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
