The End of SPRS Scores (sort of)

Episode notes

The largest change to DFARS cybersecurity requirements other than CMMC took place on February 1st, 2026, and nobody knew it happened. DFARS 7019 and 7020 have been replaced by DFARS clause 252.240-7997. Basic self-assessments have been eliminated. FAR 52.204-21 has a new number. And none of this went through rulemaking. This week we're diving deep into the mysterious world of class deviations and what they mean for defense contractors moving forward. RFO Website: DFARS RFO Deviations: CMMC class deviation: 7012 class deviation:

Related episodes across the Index

Other episodes covering the same guests and topics, from across The B2B Podcast Index.

• CMMC Is an HR Problem, Not an Enclave Problem - Here's the ProofSecure Talk Podcast · on CMMC95 / 100
• Episode 128: Post Quantum CryptographyThe Azure Security Podcast · on NIST87 / 100
• Trump's Golden Post-Quantum EO(s)Security Cryptography Whatever · on NIST80 / 100
• AI and Cybersecurity in SMBs: Insights from Bruno LecoqSecuring the Realm · on CMMC79 / 100
• Rain Versus Flood, Making Sense of the 2026 CVE SurgeResilient Cyber · on NIST76 / 100
• The Evolution and Enforcement of CMMC with Jacob AndersonTrust Issues · on DFARS76 / 100

• The DoD's "Basic" Cybersecurity Isn't Basic at All93 / 100
• A Perfect SPRS Score Turned Into a $507K Settlement64 / 100
• The DoD Said This Was "Out of Scope"... Now They're Asking About It
• CMMC Phase 2 Is Suspended... So Why Is the DoD Still Assessing Contractors?
• CMMC Phase 2 Is Suspended... But Contractor Liability Just Went UP