DFARS & FAR Cybersecurity Clause Reference
The contract clauses that drive DoD cybersecurity obligations — who each applies to, what it requires, and when it takes effect. Summaries are plain-English; the authoritative text is linked from each clause.
Key clauses
FAR 52.204-21In effect (FAR; 2016)Basic Safeguarding of Covered Contractor Information SystemsImplement 15 basic safeguarding requirements (the basis for CMMC Level 1).
Sets a baseline of 15 basic security controls for systems handling FCI. These 15 requirements are the foundation of CMMC Level 1.
Any contractor whose systems process, store, or transmit Federal Contract Information (FCI)
- Apply the 15 basic safeguarding controls in FAR 52.204-21(b)
- Flow the clause down to subcontractors handling FCI
- Maps to CMMC Level 1 (Foundational) — yes/no self-assessment
DFARS 252.204-7012In effect (since 2016; 800-171 compliance required by Dec 31, 2017)Safeguarding Covered Defense Information and Cyber Incident ReportingImplement NIST SP 800-171 and report cyber incidents to DoD within 72 hours.
Requires adequate security on covered contractor systems by implementing NIST SP 800-171, rapid (72-hour) cyber incident reporting to DoD at dibnet.dod.mil, media preservation, and flow-down.
Contractors handling Covered Defense Information / CUI
- Implement NIST SP 800-171 Rev 2 (all 110 requirements)
- Report cyber incidents at dibnet.dod.mil within 72 hours of discovery
- Preserve/protect affected-system images for at least 90 days
- Use cloud services meeting FedRAMP Moderate (or equivalent); flow down the clause
DFARS 252.204-7019In effect (interim rule, Nov 30, 2020)Notice of NIST SP 800-171 DoD Assessment RequirementsHave a current (within 3 years) NIST SP 800-171 assessment posted in SPRS before award.
Notifies offerors that, to be eligible for award, they must have a current NIST SP 800-171 DoD Assessment (not older than three years) on file in SPRS for each covered system.
Offerors on solicitations requiring DFARS 252.204-7012
- Post a current Basic (self) assessment summary score in SPRS
- Assessment must be no more than 3 years old at time of award
- Covers each system that will process/store/transmit CUI
DFARS 252.204-7020In effect (interim rule, Nov 30, 2020)NIST SP 800-171 DoD Assessment RequirementsMaintain SPRS scores and give DoD access to conduct higher-level assessments; flow down.
Requires contractors to provide the government access to facilities/systems for Medium/High DoD assessments, keep SPRS results current, and ensure subcontractors have a current assessment before awarding subcontracts.
Contractors subject to DFARS 252.204-7012
- Provide DoD access for Medium/High assessments when applicable
- Keep NIST SP 800-171 assessment results current in SPRS
- Verify subcontractors have a current SPRS assessment; flow down the clause
DFARS 252.204-7021Effective Nov 10, 2025 (48 CFR CMMC final rule); Phase 1 self-assessment in effect, Phase II+ suspended Jul 13, 2026 pending reviewContractor Compliance With the CMMC Level RequirementsAchieve and maintain the CMMC level required by the contract; affirm continuing compliance.
The CMMC contract clause: requires the contractor to have a current CMMC certificate/self-assessment at the level required by the contract and to maintain it for the contract's duration, with annual affirmations. Phased in beginning Nov 10, 2025; Phase II (C3PAO certification) and later phases were suspended Jul 13, 2026 pending a Department of War review, so the current requirement is the Phase 1 self-assessment.
Contractors on solicitations/contracts that specify a required CMMC level
- Meet the CMMC level stated in the solicitation/contract before award
- Maintain the required level for the life of the contract
- Affirm continuing compliance annually in SPRS; flow down the applicable level
CMMC phase-in schedule
The CMMC acquisition rule (DFARS 252.204-7021) took effect November 10, 2025 and was scheduled to roll out over four phases (32 CFR 170.3). The phase in effect today is highlighted.
Update (July 13, 2026): CMMC Phase II is suspended as of July 13, 2026, pending a 60-day Department of War reform review. Phase 1 self-assessment remains in effect. Source.
DoD includes CMMC Level 1 and Level 2 self-assessment requirements in most new solicitations and contracts as a condition of award.
- Level 1 (self) for FCI; Level 2 (self) for CUI where applicable
- A current SPRS score on file (DFARS 252.204-7019/7020)
- Annual affirmation by an Affirming Official
Was scheduled to begin requiring CMMC Level 2 certification assessments by a C3PAO (third party) as a condition of award for CUI contracts. Suspended July 13, 2026 pending the Department of War reform review — not a current deadline.
- Level 2 (C3PAO) certification for applicable CUI contracts
- Level 1 / Level 2 self-assessment continues elsewhere
Would have applied Level 2 (C3PAO) across a broader range of contracts and introduced Level 3 (DIBCAC) for high-priority programs. Suspended July 13, 2026 pending the reform review — not a current deadline.
- Level 2 (C3PAO) on most applicable CUI contracts
- Level 3 (DIBCAC) for designated high-priority programs
Would have made the applicable CMMC level a condition of award on all new DoD contracts (and exercised options), except commercial off-the-shelf (COTS) items. Suspended July 13, 2026 pending the reform review — not a current deadline.
- Applicable CMMC level on all in-scope contracts (COTS excepted)
Phase dates are set by rulemaking and can change. Verify current status at dodcio.defense.gov/CMMC before relying on them.
What does this mean for me?
Map your situation to a required CMMC level and timeline.