Even though the new Cybersecurity Maturity Model Certification (CMMC) meant to only add a verification component to the security requirements in DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) there is one area where it is changing the clause; sub-contractors.