DFARS 252.204-7021: the CMMC clause
Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7021, "Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements," is the contract term that turns the Cybersecurity Maturity Model Certification (CMMC) program into an obligation you can be held to. The current version is dated November 2025.
DFARS 252.204-7012 tells you to protect the information. This clause tells you to prove it, keep the proof current, and make your subcontractors do the same.
Status note. Under DFARS 204.7504(a) as deviated, this clause goes into a solicitation until November 9, 2028 only when a program office determines that a specific CMMC level is required, and from November 10, 2028 whenever contractor systems will process, store, or transmit FCI or CUI. The Phase 2 transition is suspended, so a program office may currently designate only Level 1 (Self) or Level 2 (Self). See CMMC Phase 2.
Who it applies to
The clause goes into solicitations and contracts, including task orders and delivery orders, and including acquisitions of commercial products and commercial services under FAR part 12. It does not go into contracts solely for commercially available off-the-shelf (COTS) items.
If your contract carries it, it applies to every information system you use in performance that processes, stores, or transmits Federal contract information (FCI) or controlled unclassified information (CUI).
The five requirements
Paragraph (d) of the clause is the operative list. Two acronyms run through it. A CMMC Third-Party Assessment Organization (C3PAO) is the accredited assessor that performs a certification assessment. The Supplier Performance Risk System (SPRS) is the government system of record where the status and the affirmation are posted.
| Requirement | What it means in practice |
|---|---|
| Hold and maintain a current CMMC status at the level the contracting officer inserted, or higher, for the duration of the contract | The contracting officer writes one of four values into the blank: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC) |
| Process, store, and transmit FCI or CUI only on systems that hold that status or higher | A system that is out of scope for your assessment is also out of bounds for the data |
| Complete and maintain an annual affirmation of continuous compliance in SPRS, by the affirming official, for each CMMC UID | One affirmation per unique identifier, every year, signed by a named person |
| Ensure subcontractors affirm before award and annually thereafter | You are responsible for confirming they did it, not merely for telling them to |
| If your status is Conditional, close out a valid plan of action and milestones to reach Final | A Conditional status has a clock on it |
Paragraph (d)(1)(ii) also directs you to consult 32 CFR 170.23 and flow the correct level down.
"Current" has a definition, and it is strict
The clause defines "current" rather than leaving it to judgment. Three things have to hold at once: the assessment is inside its window, nothing about your compliance has changed since the status date, and a matching affirmation is on file and not older than one year.
| Status | Maximum age | Affirmation |
|---|---|---|
| Conditional Level 2 (Self) or Level 2 (C3PAO) | 180 days | Affirmation of continuous compliance by the affirming official |
| Conditional Level 3 (DIBCAC) | 180 days | Affirmation of continuous compliance by the affirming official |
| Final Level 1 (Self) | 1 year | Affirmation not older than 1 year |
| Final Level 2 (Self) or Level 2 (C3PAO) | 3 years | Affirmation not older than 1 year |
| Final Level 3 (DIBCAC) | 3 years | Affirmation not older than 1 year |
Note the asymmetry. A Final Level 2 assessment lasts three years, but the affirmation that goes with it is annual. The assessment and the affirmation are two separate clocks, and the shorter one is the one most organizations miss.
The phrase that carries the most weight is "no changes in compliance with the requirements at 32 CFR part 170 since the CMMC Status date." If you turn a control off, the status stops being current before its calendar window expires.
The seven CMMC statuses
The clause enumerates them.
- Final Level 1 (Self)
- Conditional Level 2 (Self)
- Final Level 2 (Self)
- Conditional Level 2 (C3PAO)
- Final Level 2 (C3PAO)
- Conditional Level 3 (DIBCAC)
- Final Level 3 (DIBCAC)
Conditional means some requirements are still open on a plan of action and milestones. Final means they are closed.
The CMMC UID
A CMMC unique identifier is ten alphanumeric characters that SPRS assigns to each assessment, tied to a contractor information system. You report the UIDs for the systems that will handle FCI or CUI, and you report any change to those UIDs over the life of the contract.
One organization can hold several UIDs, because the identifier belongs to a system rather than to the company. Narrowing the systems in scope, usually with a secure enclave, is also what keeps the number of UIDs you have to maintain small.
What you report, and where
Paragraph (e) separates two destinations.
| Report | Goes to |
|---|---|
| The CMMC UIDs for systems that will handle FCI or CUI | The contracting officer |
| Any change to those UIDs during the contract | The contracting officer |
| Self-assessment results for each UID not covered by a C3PAO or DIBCAC assessment | SPRS |
| The annual affirmation of continuous compliance | SPRS |
SPRS is reached through the Procurement Integrated Enterprise Environment. See SPRS score.
Flowdown
Paragraph (f) requires you to insert the substance of the clause, including paragraph (f) itself and excluding paragraph (e)(1), into subcontracts and other contractual instruments where the subcontractor will process, store, or transmit FCI or CUI. Commercial products and commercial services are included. COTS items are excluded.
Before you award, you have to confirm the subcontractor already holds a current CMMC certificate or status at the level appropriate to the information you are flowing down, judged against 32 CFR 170.23.
That is a pre-award gate, not a post-award promise. A supplier who says they are working on it does not satisfy it.
The affirming official
The affirmation is signed by a named person, defined at 32 CFR 170.4. It is not a form the compliance team submits anonymously. A person puts their name to a statement that the organization is continuously complying.
Read that alongside the Department of Justice Civil Cyber-Fraud Initiative. An affirmation that is not true is the kind of statement that has produced False Claims Act settlements. See SPRS score for the enforcement history.
How the kit relates to this clause
| Item | Kit role |
|---|---|
| Run the access, credential, and logging controls the required level depends on | Performs |
| Keep dated records an assessor can read | Records |
| Track POA&M items and their closure dates | Assists |
| Flag a control that stopped running, so "no changes in compliance" stays true | Assists |
| Decide which level your contract requires | Organization |
| Obtain, hold, or renew a CMMC status | Organization |
| Submit a UID or sign an affirmation | Organization |
| Verify a subcontractor's status before award | Organization |
The kit does not hold your CMMC status, does not sign your affirmation, and does not talk to SPRS. See AIC CMMC Complete™.
Common questions
Is this the same as DFARS 252.204-7012? No. 252.204-7012 requires safeguarding and 72-hour incident reporting. 252.204-7021 requires a CMMC status, a UID, and an annual affirmation. A contract can carry both.
What is the difference between 7021 and 7019 or 7020? DFARS 252.204-7019 and 252.204-7020 are the NIST SP 800-171 assessment clauses that put a score in SPRS. 252.204-7021 is the CMMC clause. They overlap in SPRS and are not the same requirement.
Does the clause apply to commercial items? Yes, including commercial products and services acquired under FAR part 12. It does not apply to contracts solely for COTS items.
Do I need a separate affirmation for each system? You affirm for each CMMC UID applicable to the systems that handle FCI or CUI in performance of the contract.
What happens if my status lapses mid-contract? You no longer have a current status, and paragraph (d)(2) means those systems should not be handling FCI or CUI. Treat a lapse as a contract performance issue, not a paperwork issue.
Can I award a subcontract to a supplier who is not yet assessed? Not if that subcontract will involve FCI or CUI. Paragraph (f)(2) makes the check a condition before award.
Does the July 2026 suspension remove this clause? No. It changed which levels a program office may designate and when the clause is inserted. See CMMC Phase 2.