November 10 was supposed to be the day many defense subcontractors needed an outside assessor's sign-off on their cybersecurity to win work. It won't be. If you're a small supplier below a defense prime, that pause changes less than you think. The rules that reach you don't come straight from the government. They come through your prime's purchase order, the prime usually isn't allowed to soften them, and they decide what you spend before you ship a part and which job your shop has to run first.

Here's the date math. The defense contract rule for the Cybersecurity Maturity Model Certification took effect November 10, 2025 (Federal Register, September 10, 2025). The program's own rule says Phase 2 "begins one calendar year following the start date of Phase 1" (Code of Federal Regulations, title 32, section 170.3). On July 13, 2026, the Department of War announced "the immediate suspension" of Phase 2 and a review. In the same release it said, "All Phase I self-assessment requirements remain firmly in place," and that contractors and subcontractors are still obligated to protect covered defense information under clause 252.204-7012 (Department of War Office of Industrial Base Growth, July 13, 2026). When I checked the department's program page on November 6, it showed nothing newer.

So the self-assessment and the incident reporting clause still reach you. The bigger lesson is how they reach you. That's defense prime and subcontractor contracting, and it's where a lot of supply chain vulnerabilities start.

The prime doesn't get to soften the clause

Most buyers treat terms as negotiable. Flow-down clauses mostly aren't, because the clause itself tells the prime what to do with it. Three examples from the Defense Federal Acquisition Regulation Supplement, as the clauses read today on Acquisition.gov:

  • Cyber incident reporting (clause 252.204-7012, dated May 2024). The prime must put it in subcontracts that involve covered defense information, "including subcontracts for commercial products or commercial services, without alteration, except to identify the parties." If you have a cyber incident, you report it to the department within 72 hours of discovery and give your prime the incident report number. The same clause makes the prime decide whether the information it sends you still counts as covered defense information.
  • Cyber certification (clause 252.204-7021, dated November 2025). Before it awards you a subcontract, the prime must make sure you have a current certification status at the level the work needs, and must have you complete an affirmation of compliance before award. That flow-down applies when your work will process, store or transmit federal contract information or controlled unclassified information.
  • Magnets, tantalum and tungsten (clause 252.225-7052, dated May 2024). From January 1, 2027, the prime "shall not deliver" covered material "mined, refined, separated, melted, or produced" in China, Russia, North Korea or Iran. It must pass the substance of the clause to subcontracts for items that contain that material, "including subcontracts and other contractual instruments for commercial products."

Notice the phrase that keeps coming back: commercial products. Selling a catalog part doesn't take you out of scope.

The rating on the purchase order

The second thing that flows down is priority. Under the Defense Priorities and Allocations System, a Commerce Department regulation, a defense order can carry a "DO" or "DX" rating. The regulation sets the pecking order: DO rated orders "take preference over unrated orders," and DX rated orders take preference over DO and unrated orders (Code of Federal Regulations, title 15, section 700.11).

The supplier's side is stricter than most buyers realize. Under section 700.13, as it reads today:

  • You "shall accept every rated order received," with listed exceptions, and you can't charge higher prices or impose different terms than for a comparable unrated order.
  • You "shall not accept a rated order for delivery on a specific date if unable to fill the order by that date." You offer the earliest date you can meet instead.
  • You must accept or reject in writing within 15 working days of receiving a DO order and 10 working days of receiving a DX order, and give your reasons if you reject.
  • If you accept and later find you'll be late, you must tell the customer immediately and give a new date.

It doesn't stop with you. Section 700.15 says, "A person must use rated orders with suppliers to obtain industrial resources needed to fill a rated order," carrying the same rating. The priority runs all the way down the chain.

Here's the vulnerability for everyone else in that shop. The regulation says a supplier "must fill such orders regardless of any other rated or unrated orders that have been accepted." If you're a commercial manufacturer sharing a heat treater or a machine shop with defense work, your unrated order can be the one that waits.

Where the vulnerability comes from

Each clause makes sense on its own. Stacked together and pushed onto a shop with a few dozen people, they add up.

On June 3, 2026, Moshe Schwartz, a senior fellow at the National Defense Industrial Association, told the House Small Business Committee, "When regulations placed on prime contracts are required to be included in subcontracts at lower tiers, we are placing regulations on small businesses." He described one company that spent $100,000 last year to get its cybersecurity certification and is spending $100,000 this year on the audit, which he called a significant investment for a company "whose annual budget is $3 million." He also quoted the House Armed Services Committee chairman's draft of the 2027 defense bill, which says companies are being forced to choose between innovation and compliance, "contributing to attrition from the defense industrial base and reduced resilience across defense supply chains" (National Defense Industrial Association testimony, June 3, 2026)

The attrition shows up in the counts. The Government Accountability Office found that small businesses receiving contract awards from the Department of Defense, now the Department of War, fell "from 42,723 in 2011 to 24,296 in 2020, a decline of 43 percent" (Government Accountability Office, GAO-22-104621, October 14, 2021). That counts prime awards, not subcontracts, but it shows the direction.

Meanwhile, the buyers say they need more suppliers, not fewer. On March 24, 2026, Vice Admiral Elizabeth Okano, Principal Military Deputy to the Assistant Secretary of the Navy for Research, Development and Acquisition, told the Senate Armed Services Committee, "We cannot afford to be dependent on a handful of suppliers" (Senate Armed Services Committee testimony, March 24, 2026). On May 14, 2026, after it and the Department of War hosted more than 150 of its suppliers at a munitions supplier conference, Lockheed Martin said it would "invest in the existing supply chain by developing new second sources for key parts" (Lockheed Martin, May 14, 2026)

My read, after more than 20 years in supply chain and procurement: those two goals pull against each other. Every clause a prime must pass down is a cost a new second source carries before it ships a single part. When a small shop decides that cost isn't worth it, the prime's list of qualified sources gets shorter. That's how a contract written to reduce one risk can create a supply chain vulnerability somewhere else.

What to do this week

Before you quote your next defense job, send the prime's buyer or subcontracts administrator one email and ask for three answers in writing:

  1. Which clauses flow down? The list of clauses, with their dates, that will be in your purchase order. Ask directly whether the information they'll send you is covered defense information, because clause 252.204-7012 makes that the prime's call.
  2. Is the order rated? DO, DX or unrated. If it's rated, your 15 or 10 working-day clock to accept or reject starts when the order arrives, so know the delivery date you can really meet before it lands.
  3. Does anything you deliver contain magnets, tantalum or tungsten? If so, ask what proof of origin they'll want from you before January 1, 2027, and start asking your own suppliers for it now.

Price the job with those answers in hand. A clause you find after you've quoted is a cost you've already given away.