The Proliferation of “Fake” CMMC Contract Clauses

This advisory from TrustedSec explains that many defense subcontractors are seeing illegitimate or premature CMMC clauses in contracts drafted by prime contractors' legal teams, and that legitimate clauses will only be the finalized DFARS 252.204-7021 language (with rollout beginning Nov 10, 2025). It describes common problems—missing or incorrect CMMC level and assessment type, vague references to DFARS 7021, and improper flow-down of requirements—outlines the risks and confusion caused for subcontractors, and advises subcontractors to push back and only accept the full final DFARS 7021 clause with level and assessment requirements appropriate to the information they handle.