If you hold or bid on Department of War (formerly DoD) work, these clauses are usually why you are reading about CMMC at all. They are separate obligations that build on each other. This page explains each one, how they fit, and what a subcontractor should do on finding them in a purchase order. For the program overview, see the CMMC hub.
The four clauses at a glance
| Clause | What it requires | What you must do | Evidence |
|---|---|---|---|
| 252.204-7012 | Safeguard covered defense information; report cyber incidents | Implement NIST SP 800-171, report within 72 hours, use FedRAMP Moderate-equivalent cloud, flow down | SSP, POA&M, incident response plan, cloud provider documentation |
| 252.204-7019 | Notice: a current NIST SP 800-171 assessment is needed to be considered for award | Post a current score (not older than 3 years) in SPRS for each covered system | SPRS record of your summary score |
| 252.204-7020 | NIST SP 800-171 DoD Assessment Methodology | Do a Basic (self) assessment; give DoD access for Medium or High; check subcontractor scores | SPRS score, assessment date, system scope |
| 252.204-7021 | Hold the CMMC status the contract requires | Keep status current, affirm annually in SPRS, give CMMC UIDs to the CO, flow down the level | CMMC UIDs, self-assessment results and affirmation in SPRS |
DFARS 252.204-7012: the security obligation
DFARS 252.204-7012 is the foundation. Covered contractor information systems must meet NIST SP 800-171. Cyber incidents affecting covered defense information must be reported to DoD at dibnet.dod.mil within 72 hours of discovery, and images of affected systems kept for at least 90 days. Cloud services that store covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. The clause flows down, unaltered, to subcontracts for operationally critical support or that involve covered defense information.
DFARS 252.204-7019 and 7020: the SPRS score
DFARS 252.204-7019 is a solicitation notice: to be considered for award, you need a current NIST SP 800-171 assessment (not more than three years old unless the solicitation sets a shorter time) for each covered system, with the summary score posted in SPRS.
DFARS 252.204-7020 sets the DoD Assessment Methodology. A Basic assessment is your own self-assessment. Medium and High assessments are government reviews, and you must give DoD access to facilities, systems and people for them. Scoring starts at 110 and subtracts 1, 3 or 5 points per unmet requirement, down to -203. 7020 also flows down: before awarding a subcontract that involves NIST SP 800-171, the prime must confirm the subcontractor has a current score. See how the SPRS score works.
DFARS 252.204-7021 and 7025: CMMC status
The DFARS CMMC rule took effect November 10, 2025. The 252.204-7025 provision tells offerors which CMMC level a solicitation requires. The 252.204-7021 clause then requires you to:
- have and maintain, for the duration of the contract, a current CMMC status at the required level or higher;
- process, store or transmit FCI or CUI only on systems that have that status;
- give the contracting officer the CMMC unique identifiers (UIDs) SPRS issues for your systems, and any changes;
- keep a current self-assessment result and an annual affirmation of continuous compliance in SPRS (see the annual SPRS affirmation);
- close out a valid POA&M if your status is conditional; and
- flow the correct CMMC level down to subcontractors and confirm their status before award.
Level 1 means the 17 practices drawn from FAR 52.204-21 for Federal Contract Information, with an annual self-assessment and affirmation. Level 2 means the 110 NIST SP 800-171 Rev 2 requirements for CUI. Details are on the Level 1 and Level 2 pages.
How the clauses fit together
- 7012 says what security you must have and how to report incidents.
- 7019 and 7020 make you score that security and post the score in SPRS.
- 7021 and 7025 require a CMMC status at a named level, kept current and affirmed every year.
One body of work (implementing NIST SP 800-171 on the systems that hold CUI) satisfies the substance of all of them. The clauses differ in what evidence they ask for and where it goes.
What the suspension changed, and what it did not
On July 13, 2026 the Department of War suspended the move to Phase 2, which had been due November 10, 2026. During the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self), and program offices may not require Level 2 (C3PAO) or Level 3. A CMMC Reform Task Force is reviewing the program; see the suspension explainer.
What did not change: 7012, 7019, 7020 and 7021 are still in contracts, NIST SP 800-171 Rev 2 still applies, incident reporting still runs on a 72-hour clock, and SPRS scores and affirmations are still checked.
How to read your subcontract
Primes often incorporate clauses by number in a list of flow-downs rather than in full text. Search the purchase order, subcontract and any attached terms for "252.204-7012", "7019", "7020", "7021", "CMMC", "covered defense information" and "CUI". Also check whether the prime has marked any drawings or data you will receive as CUI.
If your subcontract has X, do Y
| If you find | Then |
|---|---|
| 7012, or you will receive CUI | Implement NIST SP 800-171, write an SSP, set up 72-hour incident reporting and check your cloud |
| 7019 or 7020 | Complete a Basic assessment and post a current score in SPRS |
| 7021 at Level 1 | Complete the 17-practice self-assessment and affirm annually in SPRS |
| 7021 at Level 2 (Self) | Complete the 110-requirement self-assessment, enter results in SPRS and affirm annually |
| No clauses, but you handle FCI | Expect FAR 52.204-21 and Level 1; confirm with the prime |
How Galaxy helps
Galaxy Consulting is a Cyber-AB Registered Provider Organization (RPO). It is not an assessment organization and does not certify anyone. Galaxy reads your clauses with you, determines scope and level (FCI vs CUI, system boundary), runs a gap assessment, helps remediate, writes the SSP and POA&M, and supports your self-assessment and SPRS affirmation. See CMMC services or book a free discovery call.
Frequently asked questions
What does DFARS 252.204-7021 require?
DFARS 252.204-7021 is the CMMC clause. It requires you to have and keep a current CMMC status at the level the contract names, for the whole contract, on every system that handles FCI or CUI. You give the contracting officer your CMMC unique identifiers (UIDs) from SPRS, keep a current self-assessment and annual affirmation in SPRS, and flow the right level down to subcontractors.
What is the difference between DFARS 7012 and 7021?
DFARS 252.204-7012 is the security obligation itself: implement NIST SP 800-171, report cyber incidents to DoD within 72 hours, use FedRAMP Moderate-equivalent cloud for covered defense information, and flow the clause down. DFARS 252.204-7021 adds the CMMC layer: proof of a current CMMC status in SPRS at the required level.
Do 7019 and 7020 still matter now that CMMC exists?
Yes. They require a current NIST SP 800-171 assessment score, not more than three years old, posted in SPRS for each covered system. Primes must confirm a subcontractor has a current score before awarding a subcontract that involves NIST SP 800-171.
Did the Phase 2 suspension remove these clauses?
No. The July 13, 2026 suspension stopped the move to Phase 2, so new requirements may only call for Level 1 (Self) or Level 2 (Self). DFARS 252.204-7012, 7019, 7020 and 7021 remain in effect, and NIST SP 800-171 Rev 2 still applies.
I am a subcontractor. Which clauses apply to me?
Whatever your prime flows down. 7012 flows to subcontracts involving covered defense information, 7020 flows to subcontracts generally (except COTS items), and 7021 requires the prime to flow down the correct CMMC level. Read your purchase order or subcontract terms and search for each clause number.
What is the 72-hour rule?
Under DFARS 252.204-7012 you must report a cyber incident affecting covered defense information to DoD through the DIBNet portal within 72 hours of discovery, and preserve images of affected systems for at least 90 days. You need a DoD-approved medium assurance certificate to file the report.
Related CMMC pages
- How the SPRS score works
- The annual SPRS affirmation
- CMMC Level 2 requirements
- CMMC Level 1 requirements
- The Phase 2 suspension explained
Talk it through with a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) in Fort Washington, Maryland. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.