DFARS 252.204-7012, 7019, 7020 and 7021 Explained

This clause is a pre-award requirement asserting that contractors must represent their ability to comply with the security requirements of NIST SP 800-171, or list out variances via a System Security Plan (SSP) and Plan of Action and Milestones (POA&M): Requires contractor systems to comply with NIST SP 800-171 when handling CUI; acknowledges that not all 110 controls may be immediately met but demands documented remediation timelines; and precludes award unless the contractor affirms a valid implementation path.

Key compliance action: Maintain current and accurate SSP and POA&M documentation prior to contract award.

The core DFARS cybersecurity clause, -7012 protects covered defense information: CUI that the DoD provides to the contractor, or that the contractor collects, develops, receives, transmits, uses or stores in support of the contract. It mandates both preventive and responsive controls: implement all 110 NIST SP 800-171 controls in covered contractor information systems; rapidly report cyber incidents, meaning within 72 hours of discovery, through the DoD's DIBNet portal using a DoD-approved medium assurance certificate; submit any malicious software found to the DoD Cyber Crime Center (DC3); preserve images of affected systems and relevant monitoring data for at least 90 days from the report so the DoD can request them; and use only cloud services that meet security requirements equivalent to the FedRAMP Moderate baseline for covered defense information.

The clause also flows down. Prime contractors must include -7012 in subcontracts that involve covered defense information, and subcontractors must report cyber incidents directly to the DoD and give the incident report number to their prime. Compliance with -7012 is not optional. It is enforceable under contract law and is often a focal point during audits and investigations.

Clause -7019 formalizes the requirement for contractors to perform and submit cybersecurity assessments to the DoD’s Supplier Performance Risk System (SPRS). Requirements include: submit a Basic, Medium, or High assessment based on NIST SP 800-171; basic assessments are self-generated, based on contractor SSPs; scores are calculated by subtracting unmet controls from 110; and assessments must be current (within 3 years) for contract eligibility.

SPRS scores are used by contracting officers during source selection and acquisition reviews, creating a direct link between cybersecurity posture and business opportunity. 2026 update: under DoD Class Deviation 2026-O0025, effective February 1, 2026, contracting officers no longer include -7019 in new solicitations. Older contracts and solicitations may still carry it, the codified DFARS still lists it until formal rulemaking, and SPRS remains in use.

Clause -7020 mandates that contractors: allow the DoD to conduct Medium or High assessments, including on-site reviews; flow down -7020 to all subcontractors that process, store, or transmit CUI; and provide documentation (SSPs, POA&Ms, evidence) upon DoD request.

This clause operationalizes enforcement by granting the DoD access to audit and validate contractor claims and is often triggered by risk-based criteria or anomalies in SPRS scoring. Medium and High assessments are performed by the government, ordinarily DCMA DIBCAC, and contractors have 14 business days after an assessment to provide additional information or rebut findings. 2026 update: under DoD Class Deviation 2026-O0025, effective February 1, 2026, new solicitations and contracts use DFARS 252.240-7997 in place of -7020. It keeps the government's right to conduct Medium and High assessments but removes the Basic self-assessment. Contracts awarded earlier still reference -7020.

Clause -7021 codifies the requirement for contractors to meet the CMMC level specified in the solicitation before contract award: CMMC Level 1 aligns with FAR 52.204-21 (basic safeguarding of FCI); CMMC Level 2 aligns with NIST SP 800-171 Rev 2 and requires either a self-assessment or third-party certification by a CMMC Third-Party Assessment Organization (C3PAO), as the solicitation specifies; and CMMC Level 3 (for critical programs) adds 24 requirements selected from NIST SP 800-172 and is assessed by DCMA DIBCAC once the contractor holds Final Level 2 (C3PAO) status.

The required CMMC status, whether a self-assessment or a certification, must be in place before award and maintained throughout contract performance, including annual affirmations of continued compliance.