DFARS cybersecurity clauses
The 2020 interim rule created the DFARS 70-series. Three rules later, one of those clauses is gone, one has been renumbered, and one is suspended in part. Here is what is actually in your contract today.
If you arrived here looking for the interim rule, start with this
The interim rule that introduced DFARS 252.204-7019, -7020, and -7021 took effect on November 30, 2020. It is no longer interim, and the clauses it created have moved. Three changes since then matter more than anything in the original rule.
November 10, 2025: the 48 CFR acquisition rule took effect, finalizing the CMMC clause and beginning Phase 1. February 1, 2026: a class deviation under the Revolutionary FAR Overhaul reorganized the cybersecurity clauses into FAR Part 40 and DFARS Part 240 — 7019 is no longer prescribed and 7020 now appears as 252.240-7997. July 13, 2026: DoD suspended the transition to CMMC Phase 2, and a September 2026 class deviation directed contracting officers to strip third-party assessment requirements from contracts.
DFARS 252.204-7012 is unchanged throughout all of it. If you handle CUI, that clause is still the source of your obligation. For the full current picture, see our CMMC compliance guide.
Clause crosswalk: old number to current status
Because the February 2026 change was issued as a class deviation ahead of formal rulemaking, the codified DFARS still lists the legacy clause numbers. Both old and new numbers can appear depending on when your contract was awarded, which is why this table is worth checking against your actual clause list rather than against memory.
| Clause | What it required | Status now |
|---|---|---|
| DFARS 252.204-7012 | Safeguard covered defense information to NIST SP 800-171, report cyber incidents to DoD within 72 hours, and use cloud services meeting FedRAMP Moderate equivalency | Unchanged. Still the operative obligation for contractors handling CUI, and unaffected by the Phase 2 suspension |
| DFARS 252.204-7019 | Submit a current NIST SP 800-171 Basic self-assessment score into SPRS as a condition of award | No longer prescribed as of the February 2026 class deviation. The self-assessment obligation itself did not disappear — it now reaches you through the CMMC clause instead |
| DFARS 252.204-7020 | Give DoD the right to conduct higher-level assessments, and require primes to confirm subcontractor SPRS scores before award | Relocated to DFARS 252.240-7997. The government assessment authority carries over; the standalone Basic self-assessment requirement was removed from the clause text |
| DFARS 252.204-7021 | Achieve and maintain the CMMC level specified in the contract as a condition of award, and flow the requirement down | Unchanged by the renumbering and finalized by the 48 CFR rule. Third-party assessment designations under it are currently suspended |
| FAR 52.204-21 | Apply 15 basic safeguarding requirements to systems handling Federal Contract Information | Relocated to FAR 52.240-93 under the deviation, with requirements unchanged. The codified FAR still publishes it at 52.204-21 |
The clause numbers changed. The security work did not.
Every renumbering and suspension since 2020 has altered how DoD verifies your cybersecurity. None of them altered what you are required to implement.
What you actually owe today
If you handle only Federal Contract Information and no CUI, you owe the 15 basic safeguarding requirements and a CMMC Level 1 self-assessment posted in SPRS, affirmed annually by a senior official.
If you store, process, or transmit CUI, you owe all 110 requirements in NIST SP 800-171 Revision 2 — today, under 7012, regardless of what phase CMMC is in. You need a current System Security Plan and Plan of Action & Milestones, a score posted in SPRS, and an annual affirmation. Applicable solicitations currently specify CMMC Level 1 (Self) or Level 2 (Self), because program managers are prohibited from designating C3PAO or DIBCAC assessments while the suspension holds.
A suspended audit is not a suspended requirement. It removes the assessor who would have caught the gap before the Justice Department did.
Your SPRS score and how it is calculated
The DoD Assessment Methodology scores your implementation of NIST SP 800-171 out of a maximum of 110 — one point per requirement. Unimplemented requirements deduct 1, 3, or 5 points depending on how much risk each one carries, which is why a score can go negative. A company that has implemented 90 of 110 requirements does not score 90; it scores 110 minus the weighted value of the 20 it is missing.
That weighting is the part contractors most often miss when they estimate their own position. Multifactor authentication, FIPS-validated encryption, and audit logging are 5-point deductions. Missing a handful of them puts a serious dent in a score that otherwise looks close to complete.
What a SPRS submission includes
- The name of your System Security Plan
- The CAGE code or codes the plan covers
- A brief description of the plan architecture
- The date the assessment was completed
- Your total score
- The date you expect to reach a score of 110
That last field is the one to think carefully about. It is a date you are putting on the record, against which your progress can later be measured.
Basic, Medium, and High assessments
The three-tier assessment structure introduced by the interim rule is still in place, and DoD’s authority to use it survived both the renumbering and the Phase 2 suspension. This is the mechanism through which the government checks self-reported scores.
The three DoD assessment tiers
-
Basic
Conducted by you
- Your own review against all 110 requirements
- Score posted in SPRS by your team
- Lowest confidence level from DoD’s perspective
-
Medium
Conducted by the government
- DoD reviews your SSP and supporting documentation
- Checks whether your described implementation is plausible
- Can revise your posted score
-
High
Conducted by DIBCAC
- On-site or virtual verification of evidence
- Tests whether controls actually operate as documented
- The tier where documentation-only compliance falls apart
Medium and High assessments are performed by DoD’s Defense Industrial Base Cybersecurity Assessment Center. A Basic self-assessment is what you submit; the other two are what happens when the government decides to check.
In June 2026 the Justice Department settled with an Alabama defense contractor for $507,144 after a DoD audit found its near-perfect self-assessment score substantially inaccurate. No third-party assessor was involved. That case is the clearest available answer to whether self-attestation is a low-risk path during the suspension.
Flow-down to subcontractors
Primes remain responsible for confirming that subcontractors handling CUI have met the applicable requirements, and the CMMC clause carries its own flow-down obligation. In practice, flow-down has been running ahead of the government’s schedule since 2025: primes are requiring documented NIST SP 800-171 implementation and SPRS scores as a condition of staying on an approved vendor list, whether or not the requirement has appeared in the subcontractor’s own solicitations yet.
If you are a sub, this is the practical answer to why the Phase 2 suspension has not slowed your customers down. Nothing stops a prime from setting a higher bar than DoD does, and inheriting a subcontractor’s risk is not something primes are inclined to do.
Four things older guidance gets wrong
Most DFARS and CMMC guidance still online was written between 2020 and 2022 and has not been revised. These four errors are the ones we see cause real, expensive decisions.
1. “Contractors handling CUI need CMMC Level 3”
This was true under CMMC 1.0, where Level 3 was the CUI tier. When the model was restructured, the old Level 3 became the current Level 2. Today, CUI means Level 2 — the 110 requirements of NIST SP 800-171 Revision 2. Current Level 3 adds 24 enhanced requirements from NIST SP 800-172 on top of a complete Level 2 foundation, and is reserved for DoD’s highest-priority programs facing advanced persistent threats. Pursuing Level 3 when your contracts call for Level 2 is one of the most expensive mistakes available in this framework.
2. “CMMC Level 1 requires 17 practices”
The final rule specifies 15 requirements for Level 1, drawn from FAR 52.204-21(b)(1). The 17 figure comes from an older mapping to NIST SP 800-171 control counts and persists across a surprising number of otherwise current pages.
3. “Prepare for Revision 3 of NIST SP 800-171”
CMMC Level 2 is locked to Revision 2. A NIST publication becomes a CMMC obligation only when DoD writes it into the rule, and as of this review that has not happened for Rev. 3. Building to Rev. 3 today means implementing controls you are not required to have while potentially missing ones you are.
This gets more confusing than it should because NIST withdrew Rev. 2 from its own catalog in May 2024, so NIST’s page for it shows as superseded. Both things are true: withdrawn as a NIST publication, still enforced by DoD. Withdrawing a publication does not amend the regulation that names it. Our NIST SP 800-171 guide covers the distinction.
4. “CMMC 2.0”
Neither “1.0” nor “2.0” is current terminology. Since the program rule took effect in December 2024, it is simply CMMC, codified at 32 CFR Part 170. Guidance still using the 2.0 label generally predates the final rule, which is a useful signal about what else in it may be out of date.
Where the interim rule came from
DFARS 252.204-7012 had required NIST SP 800-171 implementation since 2016, but compliance was verified only by contractor attestation. Adoption was poor and inconsistent, and DoD had no mechanism to detect a contractor claiming compliance it had not achieved.
The interim rule was the first attempt to fix that. It added a standardized scoring methodology so DoD could compare contractors on a common scale, required scores to be posted in SPRS as a condition of award, established the Basic, Medium, and High assessment tiers so the government could verify what contractors reported, and set up the framework for CMMC to follow.
Everything since has been iteration on that same problem. CMMC added third-party certification as a stronger verification layer; the 2025 acquisition rule put it into contract language; the 2026 review paused the third-party layer over cost and capacity concerns. The through-line across six years is that the requirement has never moved — only the mechanism for checking it.
Frequently asked questions
Is the DFARS interim rule still in effect?
Not as an interim rule. It took effect November 30, 2020 and the clauses it created have since been finalized, renumbered, or removed through subsequent rulemaking. What survives is the substance: SPRS scoring, the government’s assessment authority, flow-down, and the CMMC framework it set up.
Where did DFARS 252.204-7019 go?
It is no longer prescribed as of the February 2026 class deviation. That does not mean you stopped owing a self-assessment — the requirement now reaches you through the CMMC clause and 32 CFR Part 170 instead, with the score still posted in SPRS and affirmed annually.
Is DFARS 252.204-7020 the same as 252.240-7997?
Substantially, yes. The clause was relocated under the FAR overhaul deviation, and the government’s authority to conduct Medium and High assessments carried over. The standalone Basic self-assessment requirement was removed from the clause text when it moved. Because this is a deviation ahead of formal rulemaking, either number may appear depending on your award date.
Do I still need to post a SPRS score during the CMMC Phase 2 suspension?
Yes. Phase 1 self-assessment requirements remain in force, scores are still posted in SPRS, and affirmations are still made by a senior company official. Only the third-party certification designations are suspended.
What CMMC level do I need if I handle CUI?
Level 2 — all 110 requirements in NIST SP 800-171 Revision 2. If you see guidance saying Level 3, it is using CMMC 1.0 numbering, where the CUI tier was Level 3. Current Level 3 is a much narrower category for DoD’s highest-priority programs.
Can a negative SPRS score really happen?
Yes. Scoring starts at 110 and deducts 1, 3, or 5 points per unimplemented requirement based on risk weighting, so a contractor missing many of the heavily weighted controls can post a score well below zero. It is more common than contractors expect on a first honest assessment.
Not sure which clauses are in your contract?
SysArc is a Cyber AB Registered Provider Organization and has guided more than 1,000 DoD contractors through DFARS, NIST SP 800-171, and CMMC. We read the clause list, scope what is actually in play, and tell you where you stand — including whether you need less than you have been quoted.