Two Contracts, Two Clocks: Phase-In at Award and at Option
Halcyon Analytics is a 60-person data analytics firm. In February 2026 it wins a $9M DoD contract with a one-year base period and four one-year options; the solicitation includes DFARS 252.204-7021 and specifies CMMC Level 2 with a C3PAO assessment. Halcyon has never been assessed, its internal NIST SP 800-171 score is 74, and it has no C3PAO relationship and no budget line for an assessment this fiscal year. Separately, Halcyon holds a 2023 support contract with an Army program office, awarded before the CMMC rule took effect and containing only DFARS 252.204-7012 and 252.204-7019; that contract's second option is exercised in mid-2027 and the contracting officer has said nothing about CMMC. Halcyon's VP of contracts proposes signing the new award now and getting certified in year two, since the rules phase in over three years anyway. The CFO asks whether the phase-in schedule protects them, and whether the older contract can be left alone.
1. Does the phase-in schedule let Halcyon sign the February 2026 award now and certify later? Explain the two clocks involved.
Read the worked answer
Two different clocks are being confused. The phase-in schedule controls when DoD may put a CMMC requirement into a solicitation, contract, or option. It does not give a contractor a grace period once the requirement is already in its contract.
As published in 32 CFR Part 170 (confirm the current table before advising):
- Phase 1, from 16 December 2024: Level 1 and Level 2 self-assessment requirements may appear in new awards.
- Phase 2, from 16 December 2025: Level 2 C3PAO certification may be required for new awards.
- Phase 3, from 16 December 2026: Level 3 may be required, and certification requirements extend into option exercises.
- Phase 4, from 16 December 2027: remaining options on existing contracts.
Halcyon's February 2026 award lands in Phase 2, so a Level 2 C3PAO requirement in that solicitation is legitimate and expected. DFARS 252.204-7021 obliges the contractor to hold a current CMMC certificate at the time of award and to maintain it, including at each option exercise, for the life of the contract.
'Getting certified in year two' therefore means signing a contract Halcyon cannot perform as written - exposure to a cure notice, default termination, and False Claims liability. The phase-in protected Halcyon in 2024; it does not protect it in 2026.
2. What is the exposure on the 2023 Army contract whose second option is exercised in mid-2027?
Read the worked answer
The 2023 contract sits on the other side of the line, but only for now.
It was awarded before the rule, carries only 252.204-7012 and 252.204-7019, and its mid-2027 option predates Phase 4 (16 December 2027). On the published schedule, that option exercise is likely the last point at which DoD cannot yet attach CMMC to this vehicle - the following option, or any bilateral modification, can.
'No CMMC clause yet' is not 'no obligation'. Three things remain live:
- 252.204-7012 still requires safeguarding of CUI and incident reporting to DoD within 72 hours.
- 252.204-7019/7020 still require a current SPRS score, with affirmation, no older than three years.
- A posted score of 74 is visible to the program office and to any contracting officer making a responsibility determination. It is a competitive liability independent of CMMC.
Recommendation: do not plan to remain uncertified past mid-2027. The remediation work needed for one contract is the same work needed for the other, so the sensible play is a single programme that closes the 36-point gap and schedules one assessment that serves both vehicles.
3. The CFO wants a decision framework: bid and certify, or no-bid? What variables drive the answer?
Read the worked answer
Frame it as a schedule-and-cash question, not a compliance question.
- Time to readiness. A 74 score means roughly 36 points of gaps. That is typically 9–18 months of real work for a 60-person firm. If the contract requires a certificate at award and readiness is 14 months out, bidding is a promise the company cannot keep.
- Cost versus contract value. Certification assessment fees, remediation, staff time, and ongoing triennial assessments have to be carried against the margin on $9M over five years. If the margin cannot absorb it, the contract is not profitable even if won.
- Whether the certificate has residual market value. A Level 2 certificate is an asset across the DoD portfolio and increasingly across prime subcontracts. That argues for certifying regardless of this one bid - but on the company's own timeline, not the solicitation's.
- Alternatives. Teaming with a certified partner as a subcontractor, bidding as a lower tier, or requesting a deferral are all real options; signing without a certificate is not.
A defensible position: pursue certification as a strategic programme, and bid only where the award timeline is compatible with the certification date the company can actually hold.