CMMC and Existing Contracts

1The Question

One of the most common questions from contractors already at work is some version of this: I hold a contract with, say, two years left to run, and it was awarded before CMMC Level 2 was a requirement. Does CMMC apply to it now, and if it does, when?

The question matters because the two intuitive answers are both wrong. It is not true that a contract awarded before CMMC is permanently exempt, and it is not true that such a contract must be certified immediately. The accurate answer lives between those, and reaching it means separating three things that tend to blur together: whether the CMMC clause is in the contract today, when the clause is able to enter, and what the contract already required regardless of CMMC. Taken one at a time, the picture becomes clear.

2The Short Answer

A contract awarded before its CMMC clause existed does not automatically acquire a CMMC requirement in the middle of performance. The acquisition rule directs contracting officers to begin including the clause, DFARS 252.204-7021, in new solicitations, contracts, task orders, and delivery orders going forward, and through the phase-in the requiring activity determines where a CMMC level applies. A firm contract with no remaining options and no modifications will generally run to completion under the terms it was awarded under.

That is not the same as an exemption. The clause has several defined ways to enter existing work, the most important being the exercise of an option, and a contracting officer may move to incorporate it into a current contract through modification. Beyond that, if the work involves CUI, the substantive security obligation is almost certainly already owed under a separate clause that predates CMMC, so being awarded before CMMC does not mean owing nothing. The honest summary is that sitting mid-performance on a pre-CMMC contract buys time rather than immunity.

3How the Clause Enters a Contract

The DFARS prescription at 204.7504 directs the contracting officer to use DFARS 252.204-7021 in solicitations, contracts, task orders, and delivery orders where the requiring activity determines that a CMMC level applies, through the phase-in and then across all applicable work once full implementation arrives in late 2028. For a contract already in performance, that creates a small number of distinct entry points, and knowing which one is in play answers most of the question.

A point worth being precise about, because this guide's readers include the counsel who negotiate these instruments: adding a new material obligation such as CMMC to an existing contract is done through a modification, and a modification that changes the contractor's obligations is generally bilateral, which means it requires the contractor's agreement. The government cannot simply rewrite a contract already in performance. What gives the government its practical leverage is not the current contract but the next one, because continued and follow-on work is what the contractor wants to protect.

4What You Already Owe

Even where CMMC has not yet attached, a contract that involves CUI almost certainly already carries DFARS 252.204-7012, the safeguarding and cyber incident reporting clause that has required implementation of NIST SP 800-171 Rev 2 for years, and the contractor has been posting a self-assessment score in SPRS under the reporting provisions that accompanied it. CMMC Level 2 does not add new controls to that picture. It verifies the same 110 requirements the contractor already owes, and for most CUI work it adds a third-party assessment of them. The change CMMC introduces is verification, not substance.

This carries a sharp consequence. If the SPRS score on file overstates what is actually implemented, that gap is a present problem rather than a future one, because the score and its affirmation are representations to the government. Overstated self-assessments are the fact pattern behind the False Claims Act matters already moving in this area, and a pre-CMMC contract does nothing to shelter an inaccurate score. The reassurance a contractor draws from having been awarded before CMMC should therefore be a narrow one: it defers the assessment, but it does not defer the controls, and it offers no protection at all for a score that was never accurate.

5Options and the Two-Year Contract

The single most important variable in the two-year scenario is whether those two years are a single base period or a base period followed by option years, because an option is a decision point and an undisturbed base period is not.

Where the remaining term is carried by option years, each option exercise is a live opportunity for the requirement to appear. The requiring activity can determine that the option period requires a CMMC level, and the clause can be added through the modification that accompanies the option. Because the contractor's CMMC status has to be current at the moment the option is awarded, a contractor who waits until the option notice arrives will not have time to stand up and assess an environment, which makes the option award, in effect, the deadline.

Where the remaining term is a single base period with no options and no modifications, the contract will generally run to its end under the terms it was awarded under, and CMMC attaches at the follow-on, the recompete, or the next order rather than in the middle of the work. That is the closest thing to breathing room the rule provides, and it remains bounded by the date the next piece of work is solicited. In either shape, where a modification or an option is genuinely on the table, the specific clause language and the contract's option terms govern the outcome, which is the point at which a review with counsel earns its cost.

6The Timing Trap

The rule closed a door that contractors had long relied on, which was the ability to achieve compliance after award. A CMMC status has to be current at the time of award, including at an option award, and there is no post-award period in which to finish the work. A contractor that treats the solicitation, or the option notice, as the moment to begin readiness has already missed the window.

The arithmetic behind that is unforgiving. Readiness for Level 2 commonly runs twelve to eighteen months from a cold start, and third-party assessment scheduling adds further time on top. The interval between a solicitation and an award is short, and the interval between a standing start and an assessable environment is long, so the two do not line up unless the work began well in advance.

This is the pattern that runs through the whole program, applied here to a single contract. The consequence of CMMC does not arrive as a public deadline. It arrives through the ordinary administration of the contract: an option exercised, a modification proposed, a recompete solicited. A contractor holding a two-year pre-CMMC contract should identify the earliest of those moments and count backward from it, because that date, and not the end of the current period of performance, is the one that actually governs.

7What To Do Now

The productive response to this question is not to wait for certainty about whether the current contract will be modified, but to establish, concretely, when the requirement will first plausibly attach and to be ready before that date. In practice that resolves into a few steps that any contractor in this position can take without guessing.

Read the current contract for the clauses that reveal the data type and the obligation already in force. The presence of DFARS 252.204-7012, or any CUI markings on deliverables and reference material, indicates CUI and therefore Level 2. The presence of the basic safeguarding clause, FAR 52.204-21, now cited as FAR 52.240-93 after the 2026 renumbering, indicates FCI and Level 1. Then lay the option schedule and any known recompete dates against the phase-in, so that the earliest realistic trigger becomes a specific date rather than a general worry. Confirm that the SPRS self-assessment score on file reflects what is actually implemented, and correct it if it does not, since that exposure is present today. Finally, size the readiness effort to the earliest trigger rather than to the end of the current contract, because the assessment must be complete and current before the requirement attaches, not after.

8Sources