up:: Doing the Work MOC
PQC for Defense Contractors
A company in the defense industrial base is in an unusual position: its customer is the most aggressive post-quantum mover in the US government, and the compliance framework that customer holds it to is pinned by regulation to a control set published in February 2020. Those two facts point in opposite directions, and the practical consequence is that post-quantum reaches a defense contractor through contract clauses and program requirements rather than through its certification.
This note is general education about an acquisition regulation, not legal or contracting advice. What any solicitation requires is a question for the contracting officer and counsel.
The short version:
- ⭐ CMMC is pinned to NIST SP 800-171 Revision 2, February 2020, incorporated by reference at 32 CFR 170.2, alongside 48 CFR 52.204-21 and selected SP 800-172 requirements.
- That reference is frozen, which is the opposite of how the FTC, SEC and NYDFS rules work, and it means passing an assessment says nothing about cryptographic currency.
- CMMC phases into contracts in 4 stages, beginning on the effective date of the CMMC acquisition rule, with Phase 2 one calendar year later.
- The post-quantum requirement arrives instead through CNSA 2.0 where national-security systems are in scope, and through flow-downs written by the prime.
- So the thing to prepare for is the clause in the next solicitation, rather than the assessment.
What does CMMC actually hold you to?
A named, dated set of documents. 32 CFR Part 170 states that the program “utilizes the security standards set forth in the 48 CFR 52.204-21; National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Basic Safeguarding of Covered Contractor Information Systems, Revision 2, February 2020 (includes updates as of January 28, 2021) (NIST SP 800-171 R2); and selected requirements from the NIST SP 800-172 … February 2021 … as applicable.”
Source: 32 CFR Part 170, eCFR. Emphasis added. Publications are incorporated by reference under 170.2.
⭐ Incorporation by reference is what makes this different from every other sector in this Guide. A rule that points at “current standards” updates itself when the standards move. A rule that names Revision 2, February 2020, with updates as of January 28, 2021 does not, and cannot, until the regulation is amended. NIST SP 800-171 Revision 3 exists and CMMC does not use it.
The practical translation: an assessment against Revision 2 is a statement about a 2020 control set. A contractor can hold a current CMMC status and have made no cryptographic decision later than the framework’s publication date. That is not a criticism of the contractor; it is what the regulation asks for.
Then where does post-quantum actually arrive?
Through three channels, none of them the certification.
CNSA 2.0, where the work touches national security systems. CNSA 2.0 carries the most specific and earliest post-quantum deadlines any US authority has published, and a contractor delivering into an NSS is inside them regardless of what CMMC says.
Flow-down clauses from the prime. A prime meeting its own obligations pushes requirements down its supply chain contractually, which is how obligations move through this sector generally. The clause arrives in a solicitation before it arrives in a framework.
Program-specific security requirements, written per acquisition rather than per regulation, which is where cryptographic specifics tend to appear first for anything long-lived.
⚠️ This means the compliance calendar and the cryptographic calendar are different calendars, and only one of them is visible from inside the CMMC program.
When does CMMC actually bind?
In four phases. 32 CFR 170 sets out that “DoD is utilizing a phased approach for the inclusion of CMMC Program requirements in solicitations and contracts,” with Phase 1 beginning on the effective date of the complementary 48 CFR part 204 CMMC Acquisition final rule, covering Level 1 (Self) or Level 2 (Self) as a condition of award, and Phase 2 beginning one calendar year after Phase 1.
Source: 32 CFR Part 170, eCFR; the acquisition rule is DFARS Case 2019-D041, published 10 September 2025 and effective 10 November 2025, Federal Register.
Where does the cryptography live in a defense supplier?
| Surface | Typical zone | Note |
|---|---|---|
| CUI enclaves and file transfer | Zone 1 | The assessed boundary, and where FIPS-validated modules are expected |
| Engineering and PLM environments | Zone 1 and 2 | Design data with a decades-long sensitivity life |
| Delivered products and embedded firmware | Zone 1 | ⭐ Signed once, fielded for decades, and rarely re-signable |
| Prime and subcontractor exchange | Zone 2 | Terms set by the contract above you |
| Government-furnished systems | Zone 3 | Somebody else’s cryptography inside your perimeter |
⭐ The delivered-product row is the one with no recovery path. A shipped platform’s signing and secure-boot chain has to outlive its service life, and service lives here run decades. That is the same structural problem firmware and code signing describes, arriving in the sector with the longest fielded lifetimes of any.
What does harvest-now-decrypt-later mean here specifically?
It means the design data, not the email. Engineering drawings, materials specifications, test results and program documentation retain their value for as long as the platform is fielded, which is the textbook profile in the vulnerability test. A CUI file exfiltrated today in encrypted form is a file about a system that may still be flying in 2060.
Common misconceptions
“We’re CMMC certified, so our cryptography is current.” The certification assesses a February 2020 control set incorporated by reference. Currency is a separate question with a separate answer.
“CNSA 2.0 doesn’t apply to us, we’re a commercial supplier.” It applies by what the system is rather than by what the company is. A commercial supplier delivering into a national security system is inside it.
“We’ll wait for CMMC to add post-quantum.” That requires a regulatory amendment to the incorporated reference. The contract clause will move years earlier.
“Our prime will tell us.” They will, in a flow-down, on their timeline, in a solicitation you are bidding. Reading it for the first time at bid is an expensive place to start.
Questions people ask
What should a supplier do before any clause arrives? Inventory the CUI enclave and the delivered-product signing chain. Those are the two surfaces where a late answer is most expensive, and both are Zone 1.
Does 800-171 Revision 3 matter to us? Not for CMMC assessment, which uses Revision 2 by regulation. It shows where the control set is heading, and it matters directly for any customer who asks for it contractually.
How do we ask a prime what is coming? Directly, in the same conversation where flow-down terms are discussed, using the questions in the vendor-claims checklist pointed upward instead of downward.
Do we need FIPS-validated post-quantum modules? For CUI protection under the 800-171 regime, cryptographic modules are expected to be FIPS-validated, which makes validated post-quantum module availability a gating dependency rather than a preference. See FIPS 140-3.
What about our own suppliers? The same flow-down logic runs downward from you. A supplier that cannot answer is a schedule risk on a delivered product.
Is any of this urgent for a small supplier? The CUI inventory is small and cheap at small scale, which is exactly the argument for doing it now rather than under bid pressure.
Everything here is the map, given freely. When a supplier needs its CUI enclave and its delivered-product signing chain inventoried before the clause arrives, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.