Your prime just sent a letter reminding you that your Level 2 certification is due, or your annual questionnaire came back with Phase 2 language still in it, or a purchase order landed with a flowdown clause that reads like the July 13 suspension never happened. You are asking the reasonable question. If the DoD paused the whole thing, why is my prime still pushing?
The short version. Your prime does not work for the DoD schedule. Your prime works for its own contract risk. And that risk did not change on July 13. This piece is the practical playbook for what to do when your prime is still enforcing the requirement, how to respond without picking a fight or misrepresenting your posture, and where the actual legal exposure sits.
The Short Answer
Comply with what your prime is asking for, in writing, and treat their deadline as the real one. Do not use the DoD suspension as a reason to slow down your SPRS self-assessment, drop your POA&M, or leave a questionnaire blank. The DoD suspension does not travel down the contract chain. Your prime's language does.
If the prime's timeline is genuinely impossible because C3PAO capacity is paused, that is a specific, negotiable ask, not a general reason to stop. We cover the framing for that conversation in the pushback section below.
Is This Actually Happening Everywhere?
Yes, and the pattern is consistent enough that it is worth naming. In the three weeks since the July 13 announcement, the volume of inbound questions from subcontractors whose primes kept the deadline in place has been the single most common thing landing in our inbox. Industry writeups from multiple compliance firms are all posting variations of the same message. Primes are not backing off.
Named example. L3Harris publicly required its suppliers to hold a Level 2 certification by July 30, 2026, a deadline it set in April on its own authority as a customer. That deadline was set three months before the DoD paused enforcement of any related federal milestone, and it was not withdrawn after the suspension. If you supply L3Harris, the July 30 date is your date. Nothing about the July 13 announcement changed that.
The broader pattern. Primes that had aggressive flowdown deadlines are keeping them. Primes with softer language are, for the most part, not softening it further. What has changed is that some primes are quietly allowing milestone-based delays where the sub can show real progress but cannot get through a C3PAO because the pipeline is paused. That is a conversation, not a policy shift.
Why Primes Are Holding the Line
Three reasons, and they all reduce to the same idea. The prime's contract risk did not move.
1. DFARS 252.204-7012 flowdown is a contract, not a federal enforcement action. When a prime hands CUI to a subcontractor, the prime is on the hook if the sub's controls fail. That exposure exists at the contract level between prime and sub, independent of whether the DoD is currently enforcing certification. Our subcontractor flow-down guide walks through the mechanics of how the clause travels.
2. The security requirement itself never moved. As we covered in the Phase 2 suspension analysis, the July 13 announcement paused the certification mechanism, not the NIST SP 800-171 obligation. Primes read this the same way. They are still obligated to protect CUI, so they are still going to require the same protection from anyone downstream who touches it.
3. False Claims Act exposure did not budge. A prime that certifies to the DoD that its supply chain meets 800-171 is making a representation the FCA can reach. If a sub misrepresents its SPRS score and the prime relies on it, the exposure runs in both directions. Primes are not going to loosen the requirement that produces the evidence they need to defend their own certification.
What to Actually Do This Week
A five-step sequence. None of it is complicated. All of it is worth doing before your next check-in with the prime.
1. Get the requirement in writing, then read it literally. Pull the exact flowdown language from your subcontract, purchase order, or supplier compliance letter. Note the deliverable (self-attestation, SPRS score at or above a stated threshold, third-party certification), the deadline, and any escalation language. Requirements phrased as "aligned with CMMC Phase 2" are ambiguous now and worth clarifying with the prime in email, not on a call.
2. Confirm the deadline is unchanged. Send the prime a short email. "We noted the July 13 DoD suspension. Please confirm that the certification or self-assessment deadline in [contract reference] remains as stated." Almost every prime is now sending this confirmation proactively. If yours has not, ask. Silence from a prime is not permission to stop, and email is the record that protects you either way.
3. Keep the SPRS score honest and current. Whatever the prime asks for, the anchor artifact is your SPRS self-assessment. If the score has drifted since your last posting, update it. If it has not been posted at all, post it. A current score is the single most useful thing you can hand a prime that is trying to understand where you actually are.
4. Keep the SSP and POA&M live. The prime is going to ask for both. Your SSP should describe the system as it actually exists today. Your POA&M should show the open items with dated milestones. Neither should read like it was last updated the day after the JSVA. See how to write a POA&M if yours needs a refresh.
5. If you have multiple primes, work to the strictest. If any one of them is still enforcing Level 2 certification by a specific date, that is your program. Building the compliance posture the most lenient prime would accept is a way to lose the account of the strictest one.
How to Respond to a Compliance Questionnaire That Still Cites Phase 2
Answer the questionnaire as written, against your current state. Do not litigate the questions. A prime's supplier questionnaire is measuring their supply chain risk, and the questions do not become optional because the DoD paused the milestone that inspired them.
A specific answer pattern that works when a Phase 2 certification question comes up. "Our environment implements all 110 NIST SP 800-171 controls. Our current SPRS score is [X], posted on [date]. Our SSP and POA&M are current as of [date]. Our third-party certification path is on hold pending the DoD's resolution of the July 13 Phase 2 suspension and the return of C3PAO capacity. We will pursue certification as soon as a viable path is available."
That answer does three things. It does not claim a certification you do not have. It does not use the suspension as a reason to leave the question blank. And it makes the prime's evaluator's job easy, which is worth more than any argument you could make about the policy.
When It Makes Sense to Push Back
There is a version of pushback that primes will engage with, and a version that will get your file marked as difficult. Know the difference.
The version that works. A milestone-based extension request tied to a specific, external constraint the prime already understands. "The C3PAO pipeline is paused. We have completed our SSP, our SPRS score is [X], our POA&M shows the following closure dates, and we request a milestone-based extension until a viable certification path returns." That is a conversation about scheduling, not about substance, and most primes will engage with it in good faith. The C3PAO capacity math gives you the numbers to cite if you need them.
The version that does not work. Asking the prime to drop the requirement entirely, or arguing that the DoD suspension makes the flowdown void. It does not, and the prime knows it does not, and the ask signals that you are looking for a way out of the work rather than a way through it. That is the file note that follows you into the next award decision.
The One Thing Not to Do
Do not inflate your SPRS score to satisfy a prime's questionnaire. Do not sign a self-attestation to a prime that says you meet controls you do not meet. Do not describe your environment to a prime the way you wish it looked instead of the way it is.
False Claims Act exposure on SPRS scores did not move on July 13. The score is a certification you make to the government under DFARS 252.204-7012, and a prime that relies on it does so under that same federal backing. Misrepresentation to satisfy a prime's supplier program is precisely the fact pattern the FCA is written for, and prime-driven pressure is not a defense.
The right move under pressure is to post the honest score, document the gap in your POA&M with a realistic closure date, and let the prime decide how to handle it. That decision is theirs to make. It is not yours to make for them by shading the numbers.
We will send the next update on the CMMC review the day it lands.
The task force report, the RFI outcome, and any move by primes to soften or tighten flowdown will keep reshaping what compliance looks like on the ground. Leave a work email and we will send the analysis the day each development lands. No fear-mongering, just what changed and what to do about it.