Acquisition
DFARS 252.204-7021 CMMC contract clause
DFARS 252.204-7021 requires current CMMC status, annual affirmations, SPRS reporting, and subcontractor flowdown for covered systems.
Nov 10, 20266 min read8 sources
Why it matters
A missing CMMC status or affirmation can prevent award even when a contractor has completed its technical assessment.
The short version
- 1DFARS 252.204-7021 requires the specified CMMC status throughout contract performance for systems handling covered information.
- 2DFARS 252.204-7025 requires proposal UIDs and current status and affirmation records in SPRS before award.
- 3The planned November 10, 2026 Phase II start was suspended on July 13, 2026.
Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7021 requires contractors to maintain the Cybersecurity Maturity Model Certification (CMMC) status specified in their contract. It also requires current affirmations, assessment reporting, and subcontractor flowdown. (DFARS 252.204-7021)
Start with the level inserted in paragraph (d)(1). Then identify every system that will handle federal contract information (FCI) or controlled unclassified information (CUI).
Which CMMC clause version applies in 2026?
Acquisition.gov displays the November 2025 versions of 252.204-7021 and 252.204-7025, under its May 7, 2026 DFARS change. This explanation covers those codified texts and the later rollout suspension. (7021, 7025)
The September 10, 2025 final rule took effect November 10, 2025. It connected CMMC program requirements to contract award and performance. The program itself is defined in Title 32 of the Code of Federal Regulations (CFR), Part 170. (48 CFR final rule)
The planned November 10, 2026 Phase II start was suspended on July 13, 2026. Do not treat that planned date as an active blanket certification deadline. (Small Business Administration announcement)
The Government Accountability Office (GAO) reproduced the suspension instructions in a September 21, 2026 decision. They limit procurement requirements to Level 1 (Self) or Level 2 (Self). They also direct amendments to active solicitations requiring higher assessment levels. (GAO, B-424433.14 and related protests)
Check the actual solicitation, amendments, and applicable class deviations together. If they conflict, request written clarification from the contracting officer before submitting an offer.
What does DFARS 252.204-7021 require?
The clause requires continuous compliance across the systems used for covered contract work.
| Contractor duty | Practical action |
|---|---|
| Maintain the specified status | Track the level, assessment scope, and expiration |
| Use systems with the required status | Match data handling to assessed systems |
| Maintain affirmations | Assign an official and track annual dates |
| Report assessment identifiers | Provide identifiers and changes to the contracting officer |
| Control subcontractor compliance | Verify the required status before subcontract award |
| Resolve conditional status | Close an eligible plan of action and milestones |
These duties appear in paragraphs (d), (e), and (f). (DFARS 252.204-7021)
Use a contract worksheet with one row per system. Record the information handled, required level, assessment identifier, affirmation date, and responsible owner. Include subcontracted processing in a separate supplier worksheet.
The CMMC levels guide explains the differences among the assessment levels.
What is a CMMC UID?
A CMMC unique identifier (UID) is a 10-character alphanumeric identifier assigned to an assessment. It appears in the Supplier Performance Risk System (SPRS) for the contractor information system. (48 CFR final rule, definitions)
Use the identifier associated with the system that will perform the work. A company with several assessment scopes should check each relevant record.
Treat the UID list as part of proposal preparation. Match each entry to the planned system and its assessment scope. Reconcile that list again when the systems proposed for performance change.
What must be posted in SPRS?
SPRS holds the CMMC records that the acquisition community reviews. The official site provides separate CMMC entry guidance and training for entering, editing, and affirming records. (SPRS CMMC page)
The contractor enters applicable self-assessment results. Assessments performed by a third party or the government follow their program reporting routes. The required status and affirmation must be current for the relevant systems. (DFARS 252.204-7021(e))
Do not confuse the CMMC record with the separate National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 assessment record. SPRS provides a separate module for the latter's score, scope, assessment date, and system security plan details. (SPRS NIST SP 800-171 page)
Before submitting an offer:
- List every system that will handle contract FCI or CUI.
- Match each system to its CMMC record and UID.
- Check the required status and assessment date.
- Check the affirmation date.
- Compare the proposal's UID list with the current records.
The SPRS guide explains the records and access process.
Who completes the annual CMMC affirmation?
The affirming official is a senior company representative responsible for compliance and authorized to affirm it.
The affirmation follows each assessment, including an applicable closeout assessment, and continues annually. It states that applicable requirements are implemented and will remain implemented within the assessment scope. (32 CFR 170.4 and 170.22)
| Recorded status | Assessment currency | Affirmation |
|---|---|---|
| Final Level 1 (Self) | 1 year | Annually |
| Final Level 2 | 3 years | Annually |
| Final Level 3 | 3 years | Annually |
| Conditional Level 2 or Level 3 | Up to 180 days | At conditional status and applicable closeout |
These are the codified status rules. “Current” also requires continuing compliance, not merely an unexpired assessment date. (DFARS 252.204-7021(a))
Track assessment renewal and affirmation as separate deadlines. Ask the affirming official to review evidence before affirming, including changes to the assessed environment.
How does the CMMC clause flow down?
The clause flows down when a subcontract requires processing, storing, or transmitting FCI or CUI.
Commercial products and services are included. Commercially available off-the-shelf (COTS) items are excluded. Insert the clause's substance, including paragraph (f), but exclude paragraph (e)(1). (DFARS 252.204-7021(f))
The program's baseline flowdown rules are:
| Information and prime requirement | Minimum subcontractor status |
|---|---|
| FCI only | Level 1 (Self) |
| CUI | Level 2 (Self) |
| CUI under a Level 2 third-party requirement | Level 2 third-party |
| CUI under a Level 3 requirement | Level 2 third-party |
Here, third-party means a CMMC Third-Party Assessment Organization (C3PAO). Level 3 uses the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). The table describes the codified program; apply the rollout suspension when checking current procurement requirements. (32 CFR 170.23)
Verify the supplier's required status before award. Confirm its affirmation and plan for annual follow-up. The 2025 final rule expressly retained subcontractor assessment reporting and affirmations. (48 CFR final rule)
What does DFARS 252.204-7025 require in a proposal?
DFARS 252.204-7025 is the solicitation notice that identifies the required CMMC level and pre-award conditions.
The offeror provides relevant UIDs in its proposal and updates the list when new UIDs are generated. Before award, each covered system needs the required current status and a current affirmation in SPRS. (DFARS 252.204-7025(b) and (d))
A valid conditional status can support award under the final rule. The contractor must close its eligible plan of action and milestones (POA&M) to obtain final status. Conditional status is limited to 180 days. (48 CFR final rule, policy)
A plan alone does not establish conditional status. Check the recorded result and the program's eligibility rules before relying on it.
What to do next
- Read the inserted level in both 7021 and 7025, including solicitation amendments.
- Reconcile every covered system with its current SPRS record and UID.
- Put assessment, affirmation, and any POA&M closeout dates on separate reminders.
- Verify subcontractor status and affirmation before award.
- Resolve higher-level requirements against the July 13, 2026 suspension instructions.
Azcuna's LEDGER turns a trade study into a Decision Package in which every number cites its source and AI agents draft but never decide. It was proposed to the Army under SBIR Phase I topic ARM26BX06-NV012, and the proposal was submitted on October 21, 2026.
Questions people ask
What is DFARS 252.204-7021?
DFARS 252.204-7021 is the contract clause requiring the specified CMMC status for systems handling federal contract information or controlled unclassified information. The November 2025 text also requires annual affirmations, assessment reporting, identifier updates, and appropriate flowdown to subcontractors. Read the level inserted in your contract.
What is a CMMC UID?
A CMMC UID is a 10-character alphanumeric identifier assigned to a CMMC assessment and reflected in SPRS for a contractor information system. DFARS 252.204-7025 requires relevant identifiers in the proposal. Clause 252.204-7021 requires submission of identifiers and subsequent changes to the contracting officer.
What does DFARS 252.204-7025 require?
DFARS 252.204-7025 states the solicitation's CMMC level and pre-award conditions. Each covered system needs a current status and current affirmation recorded in SPRS before award. The offeror must provide relevant CMMC UIDs in its proposal and update the list when new identifiers are generated.
Does the CMMC clause flow down to subcontractors?
Yes, when the subcontract requires processing, storing, or transmitting federal contract information or controlled unclassified information. DFARS 252.204-7021(f) includes commercial products and services but excludes COTS items. The contractor must verify the appropriate current subcontractor status before award and ensure required affirmations are maintained.
Who signs the annual CMMC affirmation?
Under 32 CFR 170.22, the affirming official is a senior representative within the organization who is responsible for compliance and has authority to affirm it. The affirmation is submitted electronically in SPRS after assessments, including applicable closeout assessments, and annually thereafter.
Did CMMC Phase II begin on November 10, 2026?
That was the planned start date, but Phase II was suspended on July 13, 2026. The Small Business Administration announced the suspension. A September 2026 GAO decision reproduced instructions limiting procurement requirements during the pause to Level 1 or Level 2 self-assessments and directing amendments to active solicitations with higher requirements.
Sources
- 1252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements. · Acquisition.gov
- 2252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements. · Acquisition.gov
- 3Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041) · Federal Register, U.S. Government Publishing Office
- 4SBA Commends U.S. Department of War's Suspension of CMMC Phase II for Small Defense Contractors · U.S. Small Business Administration
- 5Kearney & Company, P.C.; NextGen Federal Systems LLC; Integral Federal, Inc.; Alpha Tech Alliance, LLC, B-424433.14 et al. · U.S. Government Accountability Office
- 6SPRS - Cybersecurity Maturity Model Certification (CMMC) · Supplier Performance Risk System
- 7SPRS - NIST SP 800-171 · Supplier Performance Risk System
- 832 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program · Electronic Code of Federal Regulations
Where this shows up in our work
- LEDGER, auditable Army acquisition decisions turns a trade study into a package where every number cites its source and AI drafts but never decides.
- ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
- TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.