# Contractors Clarify CMMC Solicitation Obligations

A blog by Chris Camejo explains that FAR/DFARS safeguarding clauses and CMMC obligations generally take effect when the relevant contract or subcontract is signed, while handling FCI or CUI during solicitation depends on any specific pre-contract agreement with the government. For procurement teams and bidders, the distinction affects what security requirements should be applied before award and how those requirements are flowed down to prospective subcontractors.

- Review each solicitation and any associated pre-contract agreement to identify the requirements that apply during the bid phase; do not assume post-award clauses automatically govern solicitation-stage handling.
- Contractors should flow down only applicable government requirements to prospective subcontractors, helping avoid unnecessary compliance costs and barriers to subcontractor participation.
- Distinguish obligations that apply now under a pre-contract agreement from requirements that may apply after contract or subcontract execution, and plan accordingly for the awarded work.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 20, 2026

### Government Entities
- Department of Defense (DoD)

### Sources
- [CMMC requirements don’t exist before a contract does and that distinction matters. In our new blog, Chris Camejo clarifies what #FCI and #CUI obligations apply during the pre-contract solicitation phase—and where the line actually is. Read it now! https://t.co/h0uVda9uGR](https://x.com/TrustedSec/status/2112560341678715170) - twitter-fed-procurement