Defender for Endpoint runs in GCC High with distinct portals, identity endpoints, and connectivity requirements, so your plan must align to those government-cloud boundaries from the start.
DoD removed DFARS 252.204-7019 and renumbered 252.204-7020, but the NIST SP 800-171 assessment and SPRS scoring cycle continues under CMMC and current contract clauses, so contractors need a clear, defensible approach to scoring, posting, and flowdown.
On July 13, 2026 the Department of War suspended the November 2026 CMMC Phase 2 transition, restricted new procurements to Level 1 and Level 2 self-assessments, and launched a 60-day review of the certification program. DFARS 252.204-7012 remains in effect.
DoD set two CMMC final rules on different clocks, the 32 CFR program rule took effect in 2024, and the DFARS acquisition rule on November 10, 2025 started a four-phase contract rollout that runs through November 10, 2028.
DFARS 252.204-7021 ties CMMC directly to DoD contracts and directs primes to flow the required level to subcontractors that handle FCI or CUI, with assessment specifics governed by 32 CFR part 170 and DoD guidance.