Contracts That Raise the Bar: Federal and Defense Work, Idaho Public Sector and Sector Snapshots

Why a contract can be tougher than the law

Lesson 06 explained which federal statutes reach a business because of what it is or what data it holds. A contract works differently. Nobody has to sign it. Once you sign, the clause becomes your problem, and your customer gets to check on you. A prime contractor can ask for your score, your plan, your policies and the name of the person who signs for you. An agency can write a notice deadline into the contract that is shorter than the statute.

That is why the same firm can be lightly regulated by law and heavily constrained by contract. A 40-person machine shop has no federal privacy statute of its own. If one customer is a defense prime, the shop may owe the government a documented set of 110 security requirements, a signed annual statement and a 72-hour incident report. Managers who learn this from a purchase order, three weeks before award, are in a poor position.

FAR 52.204-21: the floor for any federal contract

The Federal Acquisition Regulation (FAR) is the rulebook for most federal purchasing. Clause 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, appears in contracts where the contractor's systems may hold Federal Contract Information (FCI). The eCFR copy I read on October 15, 2026 is the November 2021 version. The clause defines FCI as non-public information provided by or generated for the Government under a contract to develop or deliver a product or service. It leaves out information the Government releases to the public and simple transactional information such as the data needed to process payments.

The clause lists 15 requirements in paragraph (b)(1). They are short, and a well-run small company already does most of them. The management task is to prove it. This table gives each in plain words with the evidence a manager can show.

Paragraph (c) requires the substance of the clause in subcontracts where the subcontractor may have FCI in or passing through its systems. That covers subcontracts for commercial products and services. It does not cover commercially available off-the-shelf items. So if you buy cloud hosting or managed IT from a vendor that will touch the prime's data, the clause goes to that vendor too.

The 15 items are also the whole of CMMC Level 1. Lesson 04 gave the one-line version. If a solicitation calls for Level 1 (Self), the affirmation you sign each year is a statement that all 15 are in place. There is no plan of action for Level 1 under 32 CFR 170.21(a)(1): each requirement is met or it is not.

One numbering note. A vendor summary of a 2026 DoD class deviation says the Revolutionary FAR Overhaul renumbers this clause as 52.240-93, and that DFARS 252.204-7020 became 252.240-7997 on February 1, 2026 while 252.204-7019 was eliminated. I could not read the deviation itself. The eCFR text I did read still carries 52.204-21, 252.204-7020 and 252.204-7019, so treat the renumbering as reported but unverified, and use the number your contract cites.

Three other FAR clauses show up in the same contracts and matter to technology buyers. 52.204-25 (NOV 2021) bars contracting for certain telecommunications and video surveillance services or equipment. That is the one an audiovisual or security-camera integrator should read first. 52.204-23 (DEC 2023) covers Kaspersky Lab products, and 52.204-27 (JUN 2023) bars a ByteDance covered application, TikTok being the named example, on devices used in contract performance. Check titles and dates on eCFR each year.

DFARS 252.204-7012: when the data is covered defense information

The Defense Federal Acquisition Regulation Supplement (DFARS) adds DoD-specific clauses. Clause 252.204-7012, in the May 2024 version on eCFR, applies when a contractor's systems hold covered defense information. The clause defines that as unclassified controlled technical information or other information in the Controlled Unclassified Information (CUI) Registry that requires safeguarding, and that is either marked or identified in the contract, or collected, developed, received, transmitted, used or stored in support of performance. Five duties matter for a manager.

Paragraph (m) sends the clause down, without alteration except to identify the parties, in subcontracts for operationally critical support or where covered defense information is involved, including subcontracts for commercial products and services. Subcontractors must give the prime the DoD-assigned incident report number as soon as practicable and tell the prime about any variance requests.

SPRS, 7019 and 7020, and the score on your front door

The Supplier Performance Risk System (SPRS) is where DoD keeps contractor assessment results. Under the 2023 versions of 252.204-7019 and -7020 on eCFR, an offeror that must implement NIST SP 800-171 needs a current assessment, not more than three years old unless the solicitation says otherwise, posted in SPRS for each covered system. A Basic Assessment is a self-assessment that carries a Low confidence level because the contractor generated the score. Medium and High assessments are done by Government personnel. The scoring method, the DoD Assessment Methodology, is the document the clause cites.

The CMMC rule at 32 CFR 170.24 uses the same idea. A Level 2 score starts at the number of requirements, 110, and each unmet requirement subtracts its value, so the score can go negative. Values run 1, 3 or 5 points. A requirement can score partial credit only in limited cases such as multi-factor authentication. Evidence must be in final form: the rule says working papers, drafts and unapproved policies are not acceptable.

NIST SP 800-171: Revision 2 or Revision 3

This question causes more wasted money than any other in this lesson, so the facts first. NIST published Revision 3 on May 14, 2024. NIST's Revision 2 page now says it was withdrawn on May 14, 2024 and superseded by Revision 3. Revision 3 organizes its requirements into 17 families, which are the 14 families of Revision 2 plus Planning, System and Services Acquisition, and Supply Chain Risk Management. I counted the numbered requirement headings in the Revision 3 PDF: 130 identifiers, of which 33 are marked Withdrawn, leaving 97 requirements. Revision 2 has 110. Revision 3 also uses organization-defined parameters, which are blanks that DoD or the contracting agency fills in.

The management rule is simple. Build to Revision 2 where a contract or CMMC level cites it, and keep a one-page map from Revision 2 requirements to Revision 3 so the later move costs weeks instead of months. Do not pay for a Revision 3 certification of anything. There is no such certificate.

CMMC in operation: levels, assessments, affirmations

The Cybersecurity Maturity Model Certification (CMMC) program is codified at 32 CFR Part 170, and the acquisition side sits in 48 CFR 204.75 and clause 252.204-7021. The part-170 rule was published October 15, 2024 and, per the eCFR version history, took effect December 16, 2024. The DFARS rule (DFARS Case 2019-D041, 90 FR 43560) was published September 10, 2025 and took effect November 10, 2025.

The contract mechanics are in the DFARS text. A contracting officer may not award to an offeror without a current CMMC status at the required level, and checks SPRS for a CMMC unique identifier (UID) for each contractor system that handles FCI or CUI (48 CFR 204.7502 and 204.7503). Levels 2 and 3 may be held as Conditional for no more than 180 days. Level 1 needs a Final status for award. Clause 252.204-7021 then requires you to keep the status current for the life of the contract, to affirm annually in SPRS, and to confirm before subcontract award that each subcontractor holds the right status for what it will handle.

The plan of action rules, because they decide whether you can bid

32 CFR 170.21 lets an organization earn a Conditional Level 2 status with open items only if three tests pass. The score divided by 110 must be at least 0.8, which is 88 points. No open item may be worth more than one point, except that CUI encryption that is used but not FIPS-validated may be listed even though it carries three points. And six requirements may never be on the plan: external connections, control of public information, the system security plan, escorting visitors, physical access logs and managing physical access. Closeout must be confirmed by a POA&M closeout assessment within 180 days of the Conditional status date, or the status expires. Level 1 gets no plan at all.

The affirmation

An Affirming Official from each organization, prime or subcontractor, affirms continuing compliance after every assessment, after any plan closeout, and annually. It is entered electronically in SPRS and names the official and attests that all applicable requirements are implemented and will be maintained across the whole assessment scope (32 CFR 170.22). This is where the Department of Justice's Civil Cyber-Fraud Initiative and the False Claims Act come in: a signed statement that is not true can create liability. The official needs to see evidence, not assurances.

Where the phases stand: the July 2026 suspension

The rule text in 32 CFR 170.3(e) sets four phases, each starting one calendar year after the last, counted from the effective date of the DFARS rule. With a November 10, 2025 start, that produces November 10, 2026, 2027 and 2028 for Phases 2, 3 and 4. Phase 1 puts Level 1 or Level 2 self-assessment requirements into applicable solicitations as a condition of award. Phase 2 was to add Level 2 (C3PAO) as a condition of award and let DoD include Level 3. Phase 3 was to apply Level 2 (C3PAO) to all applicable solicitations. Phase 4 was full implementation including option periods.

On July 13, 2026, according to reports from Wiley, Morgan Lewis and Latham and Watkins, DoD announced that it was suspending Phase 2 and issued two memoranda: a CMMC reform memorandum from the DoD chief information officer and an implementing memorandum on procurements. The reports agree on these points.

• Phase 1 is not suspended. Level 1 (Self) and Level 2 (Self) requirements stay in applicable solicitations.
• During the review, program offices may require only Level 1 (Self) or Level 2 (Self). They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments, and the case-by-case waiver process is halted.
• Contracting officers are to amend active solicitations and to remove third-party requirements from existing contracts by modification before the next option period or scheduled administrative modification.
• A CMMC Reform Task Force is reviewing the program for 60 days. A request for information closed on August 14, 2026. The Phase 3 and Phase 4 dates are described as in question.
• DFARS 252.204-7012, the 110 Revision 2 requirements, SPRS scores, system security plans, subcontractor flow-down and annual affirmations all remain. DOJ's Civil Cyber-Fraud Initiative is unaffected.

Three cautions. First, the suspension was done by memorandum. The text of 32 CFR 170.3(e) in the eCFR version I read, with its Phase 2 language, has not been amended since December 16, 2024. A later rule could restore, modify or drop the third-party requirement. One report warns that third-party assessments could return in changed form. Second, a vendor-maintained timeline says the task force's 60-day period closed on September 11, 2026 and that its report had not been released when that page was last updated. I could not confirm whether it has been released since, though a vendor tracker's October 1, 2026 entry still listed it as unreleased. Third, some primes are still telling suppliers to keep maturing their programs, per the same timeline. A prime can ask for more than DoD does. Read your subcontract, not the news.

What it costs, labeled honestly

No agency publishes a price list for your situation. Three figures are in circulation, and all three come from secondary sources. A security firm's estimate quoted in a vendor article puts a C3PAO assessment fee alone at $35,000 to $75,000. The same article attributes to DoD a total estimate of $105,000 to $118,000 for a three-year Level 2 (C3PAO) cycle including two annual affirmations. The DoD announcement, as Wiley reports it, cites Small Business Administration reports of costs up to $600,000 per company. These ranges differ because scope differs, which is the point of the CUI enclave in the worked example below. Treat the figures as order-of-magnitude, and get written quotes.

Capacity is a second constraint. Vendor summaries of the CMMC accreditation body's town halls give about 100 authorized C3PAOs and roughly 1,000 Level 2 certifications issued by spring 2026, against an estimate of about 76,000 organizations that would need one. Those numbers are unverified and will have moved. They explain why assessor schedules, not just fees, drive a project.

Flow-down, subcontractors and the reusable evidence pack

The chain in the picture is why a small shop with no direct federal contract can still be audited. Clause 252.204-7021(f) tells the prime to put the substance of the clause in subcontracts that will involve FCI or CUI, and to confirm before award that the subcontractor has a current CMMC status at the level suited to the information flowed down. Paragraph (d)(4) requires the prime to ensure subcontractors complete an affirmation before award and every year. 32 CFR 170.23 governs which level to flow down; I did not read that section, so check it before writing a subcontract.

Whether you are the prime or the sub, the same evidence gets requested over and over, in different forms. Build it once. The evidence pack below is a folder, a spreadsheet and a calendar.

Lesson 09 covers how to read and answer the questionnaires you receive from customers, and lesson 18 turns the pack into a metrics page for the board.

Idaho state and local government as your customer

Idaho's executive agencies get their technology through a few channels, and a vendor who understands them avoids surprises. The Idaho Office of Information Technology Services (ITS) supports executive agencies and runs enterprise tools. The Idaho Technology Authority (ITA) sets statewide IT and telecommunications policy, including standards, guidelines and risk assessment criteria, and publishes them at ita.idaho.gov. The Division of Purchasing runs statewide procurement under the State Procurement Act, Idaho Code Title 67, chapter 92.

What the state publishes that bears on a vendor

The ITA policy page, last updated February 20, 2026, lists a security series. I read the titles, not the full text of each, so the table says what exists and leaves the content to you.

The page has no document titled for vendors or third parties; the closest are the cloud and file storage items. I could not confirm from the pages I read how far ITA policy reaches beyond executive agencies, for example to counties, cities and school districts, so ask each customer which policies it adopts by contract. Nor did I find a fixed state cloud certification program on the pages read.

One gate matters for security vendors. ITS's Technology Approvals page says agencies must have ITS review and approve IT expenditures that fall in listed categories and/or exceed $5,000, whether or not bought through a state contract. IT security products and services are on the list with no dollar threshold, while network equipment, software purchases and renewals, and phone systems carry a $5,000 threshold. It also says approval is required before any Division of Purchasing activity for IT investments, such as a request for proposals, citing IDAPA 38.05.01.033. Practically, if you sell security services to a state agency, expect the agency to run your purchase through ITS first. Build that time into the sales cycle.

Idaho Code 28-51-105: what the agency must do, and what that means for you

The breach notice statute (lesson 07 covers it for businesses) has a second job when the data owner is public. I read the current text on legislature.idaho.gov. It applies to a city, county or state agency, an individual or a commercial entity that owns or licenses computerized personal information about an Idaho resident. Three sentences bear on vendors.

• When an agency becomes aware of a breach of the security of the system, it must notify the office of the Idaho Attorney General within 24 hours of discovery. A commercial entity has no such 24-hour duty in the text.
• The section does not relieve a state agency of reporting a security breach to the office of the chief information officer in the Department of Administration under Idaho Technology Authority policies.
• An entity that maintains computerized personal information it does not own or license must notify and cooperate with the owner or licensee "immediately following discovery" if misuse occurred or is reasonably likely. Cooperation includes sharing relevant information.

Read together: an agency that hires you to run its portal, host its data or process its forms is on a 24-hour clock to the Attorney General, and you are the party that discovers the problem first. So the contract will usually ask you to tell the agency within hours, not days. The statute gives "immediately following discovery" as the floor for a maintainer. The same section makes a governmental employee who intentionally discloses protected personal information guilty of a misdemeanor, with a fine up to $2,000, up to a year in county jail, or both. That sentence is about employees of the agency, but it explains why agency staff are cautious.

The Public Records Act: what your proposal and deliverables may become

Idaho's Public Records Act is Idaho Code Title 74, chapter 1. A vendor who sells to an agency should assume the contract, the price, much of the proposal and the deliverables are reachable. I read the current text of sections 74-101 to 74-118 and the procurement sections 67-9209 and 67-9215. The statute was amended in 2025 on the response times, so older summaries may be out of date.

Practical steps follow from the text. Put anything you consider a trade secret in a separately labeled attachment and say so in the cover letter, so you can show reasonable efforts. Keep security architecture, diagrams and vulnerability results in an annex that cites 74-105(4)(b) and 74-105(21) where they apply, and keep prices in the main document because expenditure records stay public. Ask the agency contact in writing to tell you if a request arrives that touches your material. The statutory text I read does not require an agency to notify the submitter before release, and it requires marking only for a different category (the tax records in 74-107(24)). So marking is evidence for your trade secret claim, not a legal precondition. That reading is mine, not a court's.

Law enforcement data and CJIS-style terms

If your work touches criminal justice information, such as a records system for a sheriff or police department, the Federal Bureau of Investigation's Criminal Justice Information Services (CJIS) Security Policy applies through the agency's agreements. The FBI resource center page lists Version 6.1, and the file name suggests a June 25, 2026 release; the page text I could read did not describe contractor terms, personnel screening or compliance dates, so verify them in the policy PDF before bidding. Expect fingerprint-based background checks for staff with unescorted access, restrictions on where data is stored, and incident reporting to the agency. These come from the agency agreement and the policy, not from state law alone.

Data residency

Idaho's student data statute shows how a data location rule reads. Idaho Code 33-133(3)(c) says that, unless the State Board of Education approves otherwise, confidential data shall not be transferred to any federal, state or local agency or other entity outside Idaho, with listed exceptions that include the State Board or Department sharing data with a vendor to the extent necessary under a contract. An out-of-state hosting region for a school application is a question for that clause. The same pattern appears in contracts for other agencies, where the clause may require US-only storage or US-based support staff. Ask early.

Sector snapshots

Lessons 05, 06 and 07 cover PCI, federal and state laws at the statute level. This table is about the vendor's position: what a customer in each sector is required to do, and what that customer will therefore demand of you. The Idaho and federal citations were read on the official source unless marked.

Two reminders. These customers did not choose to pass the duty to you out of caution alone. In several cases, the rule itself requires them to put it in the contract, so negotiating the clause away may cost them their own compliance. And the clause you sign is a promise. Do not sign a business associate agreement, a student data addendum or a Safeguards addendum that you cannot operate.

Foreign ownership, the DOJ Data Security Program and export control

Two federal regimes touch smaller firms that have foreign staff, foreign vendors or foreign investors. Neither is a security standard. Both are prohibitions or conditions on data and technology moving to certain people.

The Department of Justice's Data Security Program is codified at 28 CFR Part 202. It took effect at 12:01 a.m. Eastern on April 8, 2025. It restricts or prohibits certain transactions that give countries of concern or covered persons access to bulk U.S. sensitive personal data or government-related data. A vendor agreement, which includes cloud services, an employment agreement or an investment agreement with a country of concern or covered person is a restricted transaction that a U.S. person may do only if it complies with the security requirements (202.401). U.S. persons engaging in any restricted transaction had to develop and implement a data compliance program by October 6, 2025 (202.1001), with an annual certification by a responsible officer, and must keep records for at least 10 years (202.1101).

Most 10 to 500 person firms are below every threshold. A health clinic network, a payroll processor or a fitness app may not be. The test for a manager is to know which data sets you hold at what volume, who among your vendors and staff is located in or tied to a country of concern, and whether any contract gives them access. Lesson 09 touched the same program from the vendor side.

Export control is the second. Under the Export Administration Regulations, releasing technology or source code to a foreign person in the United States is a deemed export to that person's most recent country of citizenship or permanent residency (15 CFR 734.13(a)(2) and (b)). The International Traffic in Arms Regulations apply the same idea to technical data on defense articles (22 CFR 120.50(a)(2)). So a foreign national engineer on your payroll, or a foreign vendor with remote access to your drawing server, can create a license question if your drawings or software are controlled. Whether an item is controlled depends on its classification under the control lists; this lesson does not classify anything. Defense manufacturers should have the classification question answered before the first foreign hire has access to engineering files.

Questions to ask your IT provider or prime contractor

• Which data do we handle on this contract: FCI, CUI, both, or neither? Where in the contract or marking does it say so?
• Which clauses and which NIST revision does our subcontract cite, and what date governs the version?
• What is our current SPRS entry, who posted it, what evidence supports each requirement and when was it last checked?
• Does any vendor of ours store, process or transmit CUI, and does it meet the FedRAMP Moderate equivalent in 7012? Where is that in writing?
• Who will file a 72-hour report, do we hold the medium assurance certificate, and how do we preserve images for 90 days?
• Which person will sign our affirmation, and what will that person see before signing?
• For our state or local customers: which ITA policies does the contract adopt, what notice time do we owe, and where may our data and support staff be located?
• If our proposal is requested under the Public Records Act, who tells us, and what did we label?
• Do any of our staff, vendors or investors raise a foreign-person or country-of-concern question?

What is verified and what is not

This is the list I would want if I were signing an affirmation.

Questions and answers

We are a 30-person shop with one defense customer. Which clause do we ask the prime about first?

Ask which clauses are in the subcontract and what data type the work involves. If it is FCI only, FAR 52.204-21 and a Level 1 affirmation are the starting point. If CUI is involved, DFARS 252.204-7012 and a Level 2 status are in play. Do not guess: the data type decides the program.

Does the Phase 2 suspension mean we can skip the assessment?

It means DoD should not require a third-party Level 2 assessment in new solicitations for now. The reports say Level 2 (Self), the 110 requirements and the annual affirmation remain. A prime can still ask for more. Read your subcontract and ask the prime in writing.

What is the difference between FCI and CUI?

FCI is non-public information provided by or generated for the Government under a contract. CUI is a narrower and more sensitive category that a law, regulation or Government-wide policy says must be safeguarded, listed in the national CUI Registry. All CUI is also non-public contract information, but most FCI is not CUI. That distinction decides whether you face 15 requirements or 110.

Who should be our Affirming Official?

The rule describes the senior-level representative responsible for the organization's compliance who has authority to affirm it. In a small company that is usually the owner or chief executive. Choose someone who will read the evidence before signing, and keep a note of what they read.

Our proposal to a state agency has our pricing and our design. What is public?

Prices at a state bid opening are public under 67-9209(3), and expenditure records stay open even where other records are exempt. Trade secrets, including those in RFP responses, are exempt under 74-107(1). Cybersecurity device and system records may fall under 74-105(21) or the critical infrastructure paragraph. Separate and label these parts so the agency can withhold them and you can defend the claim.

A competitor filed a public records request for our proposal. How long do we have?

Not long. An Idaho resident, which includes a domestic entity, gets an answer in three working days from the agency, extendable to ten working days with written notice. The statute I read does not require the agency to tell you first, so keep a contact who will. If the agency releases material you claim as a trade secret, the denial and appeal route in 74-115 lets you stand in the case if a requester sues.

Do we need our own CJIS compliance to sell to a sheriff's office?

If your staff or systems can reach criminal justice information, the agency's CJIS obligations flow to you by agreement. Ask for the agency's security addendum and the policy version it uses before you bid, because staff screening and hosting rules affect price.

Does export control matter to a company with no foreign customers?

It can. A deemed export happens when controlled technology or source code is released to a foreign person in the United States, so a foreign national employee or a foreign remote support vendor can raise it. Classify your controlled items before granting access to engineering files.

Hard questions

"If DoD suspended the hard part, why should we spend money now?"

Because the suspension covered the third-party assessment, not the duty. DFARS 252.204-7012 and the 110 Revision 2 requirements remain, scores in SPRS remain, annual affirmations remain, and DOJ's False Claims Act initiative is described as unaffected. An affirmation you cannot back up is the exposure, and it exists with or without an assessor. The spending is also reusable: scope work and a CUI boundary pay off whether the third-party requirement returns, changes or goes away.

"The reports are law firm summaries. Why trust them over DoD?"

You should not trust them over DoD, and this lesson says which parts are secondary. Three independent firms agree on the date, the suspension of Phase 2 and the survival of Phase 1, and they describe the same two memoranda. Before you act on a contract term, get the DoD release and the amended solicitation language. The eCFR text of 32 CFR 170.3(e) still shows the original Phase 2 wording, which tells you the change was made by memorandum.

"Why should the owner sign an affirmation that exposes her personally?"

The rule makes an Affirming Official responsible for ensuring compliance and with authority to affirm it. The alternative is that nobody with authority reads the evidence, which is the pattern behind false statement cases. A signature backed by a reviewed evidence pack is a defensible one. One backed by an IT provider's assurance is not.

"Idaho's records law favors disclosure. Is it safe to bid at all?"

Yes, with discipline. The statute exempts trade secrets in RFP responses and cybersecurity system records, protects RFI responses from vendors that do not bid, and lets you stand in a court case over your records. What it does not protect is price and anything you fail to label or secure. Companies that treat the proposal as a disclosure document from the first draft lose little.

"Our state customer says its data must stay in Idaho. Is that legal to require?"

Nothing I read prevents a contract from requiring it, and Idaho Code 33-133(3)(c) is an example for student data where an out-of-state transfer needs board approval, with listed exceptions. Decide on cost: Idaho-only hosting or support may narrow your vendor options. Ask early and price it.

"Is the sector table a substitute for reading the contract?"

No. It tells you what to expect. The contract governs. Where the table and a clause differ, the clause is what you promised, and the statute text on the official source is what the clause is trying to meet.