Which DFARS Clause Establishes CMMC? 7021, 7025 and 7012
By Shaheer Malik · Updated Oct 28, 2026
DFARS 252.204-7021, “Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements,” is the clause that establishes CMMC requirements in a contract. Solicitations that include it also carry the provision at 252.204-7025, the notice of CMMC level requirements.[1]
The clauses
| Clause | What it does |
|---|---|
| 252.204-7021 | Requires the CMMC level named in the contract, at award and for the life of the contract |
| 252.204-7025 | Solicitation notice of the CMMC level requirement |
| 252.204-7012 | Safeguarding covered defense information (NIST SP 800-171) and reporting cyber incidents |
| 252.240-7997 | NIST SP 800-171 DoD Assessment Requirements: access for government Medium and High assessments |
From the revised DFARS part 240 issued with Class Deviation 2026-O0025, Revision 3.[1]
When 7021 goes into a contract
Until November 9, 2028, contracting officers insert 252.204-7021 when the program office determines the contractor needs a specific CMMC level. From November 10, 2028, it goes into contracts where the contractor will use its own systems to process, store or transmit FCI or CUI.[1] COTS-only acquisitions are excluded either way.[1]
What contracting officers check
They must check SPRS and not award, exercise an option or extend performance unless the contractor has a current CMMC status at the required level for each CMMC unique identifier covering the systems that handle FCI or CUI.[1] A Conditional Level 2 or Level 3 status can be used for up to 180 days; Level 1 needs a Final status.[1]
2026: the FAR overhaul and the Phase 2 suspension
Under the Revolutionary FAR Overhaul, DoD’s safeguarding and CMMC rules moved into DFARS part 240, used by class deviation in place of the codified text. The September 3, 2026 revision also tells contracting officers to remove or revise CMMC requirements under the July 13 suspension memo: Level 1 (Self) or Level 2 (Self) may be required, NIST SP 800-171 Rev. 2 under 252.204-7012 remains the baseline, and the November 2026 Phase 2 transition is suspended.[2]
The assessment clause that used to be 252.204-7020 now appears as 252.240-7997 in that text.[1] Read your own contract for the clauses and dates it actually carries.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
Which DFARS clause establishes CMMC requirements?
DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, with the solicitation notice at 252.204-7025.
Is DFARS 252.204-7012 the same as CMMC?
No. 7012 requires safeguarding covered defense information to NIST SP 800-171 and reporting cyber incidents. CMMC (through 7021) requires a verified status at a named level.
Was DFARS 252.204-7021 removed in 2026?
No. The revised DFARS part 240 issued on September 3, 2026 still contains 252.204-7021 and 252.204-7025; contracting officers were told to revise CMMC requirements so that self-assessments are used during the Phase 2 suspension.
Sources
- Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on the rules behind cmmc
- CMMC vs NIST SP 800-171: The Difference, and Rev 3
- SPRS Score and CMMC: What It Is and How It’s Calculated
- FCI vs CUI in CMMC: What Each Is and Why It Matters
- CMMC and ITAR: Does One Satisfy the Other?
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.