DFARS 252.204-7019 vs 7020 vs 7021: What Each Clause Triggers

DFARS 252.204-7019, 7020 and 7021 arrived together, sit next to each other in solicitations, and get treated as one requirement. They aren’t. They do three different jobs, they bind different parties, and after the CMMC Phase 2 suspension they sit in three different states. For how these fit with 7012 and FAR 52.204-21, start with DFARS and FAR Cybersecurity Clauses: What Each One Actually Requires.

One line each:

• 7019 — you must have posted a score to be eligible for award
• 7020 — the government can come check, and you must verify your subs
• 7021 — you must hold a CMMC status and affirm it annually

DFARS 252.204-7019: the eligibility gate

This is a notice clause, which is why it’s easy to skim past. It tells offerors that to be considered for award, they must have a current NIST SP 800-171 DoD Assessment on record in the Supplier Performance Risk System.

Current means not more than three years old. That’s the trigger nobody diaries. A score posted in year one quietly expires in year four, and contractors discover it when a proposal is found ineligible — not while doing compliance work. Score expiry belongs on your list of trigger events alongside contract award and prime changes.

The score comes from the DoD Assessment Methodology: start at 110, deduct 5, 3, or 1 point per unimplemented requirement, floor at -203. Negative scores are normal early on and not disqualifying by themselves.

What matters is that a score exists, that it’s current, and — increasingly — that it’s defensible. A contracting officer can see your score before award. So can a prime evaluating you as a supplier. A score you can’t substantiate is worse than a low score you can, because the low score is a starting position and the unsupportable one is a representation.

DFARS 252.204-7020: the government’s right to check

7020 does two distinct things, and most contractors only know the first.

It preserves the government’s assessment authority. DoD may conduct a Medium or High assessment of your environment. In practice that’s DIBCAC, and a High assessment is an on-site review of evidence against all 320 objectives. This authority is entirely unaffected by the CMMC suspension.

It makes you responsible for your subcontractors’ scores. Before awarding a subcontract to a supplier that will handle CUI, you must ensure that supplier has its own current assessment posted in SPRS.

That second obligation is an active verification duty, not a paperwork one. Flowing the clause down does not satisfy it — you have to confirm the score is actually there. Primes who assume the clause does the work carry a gap they don’t know about. Flowdown: which clauses you must pass to your subcontractors covers how to run that check, and vendor and partner selection covers what to do when a supplier’s score is a problem.

DFARS 252.204-7021: the CMMC clause, and where it stands

7021 attaches a CMMC level to a specific contract. Where DoD designates a level, you must hold that status or higher at award, maintain it for the duration, and complete an annual affirmation of continuing compliance through a named affirming official.

On July 13, 2026, DoD suspended CMMC Phase 2, including the November 10, 2026 milestone that would have made third-party C3PAO assessments mandatory for most Level 2 contracts.

What that did and did not do:

The clause was not repealed. The CMMC program rule at 32 CFR Part 170 and the acquisition rule creating 7021 both went through full notice-and-comment rulemaking and remain on the books. Unwinding them would require new rulemaking. What was suspended is the department’s exercise of discretion in designating levels and requiring certification assessments. As of the suspension, 7021 was listed as “TBD” on DoD CIO’s CMMC resources page.

The clause can still appear in solicitations. If you hold a contract with a 7021 certification condition, expect a modification. If you’re mid-proposal on a solicitation that required certification, expect an amendment. Neither is automatic — see a clause in a contract you already signed for how to handle the first case.

Existing certifications still count. 7021 permits a higher certification level to satisfy a lesser designation, so a completed Level 2 certification remains valid and remains a differentiator with primes and in M&A diligence.

Phase 1 self-assessments continue. Level 1 and Level 2 self-assessment requirements were never suspended, and neither were the annual affirmations attached to them.

The part that catches subcontractors

The suspension binds DoD. It does not bind your prime.

7021 requires primes to flow down the substance of CMMC requirements. A prime managing its own liability may well keep certification language in subcontract terms regardless of what DoD paused — and it is entirely within its rights to do so.

Relief does not flow downhill automatically. If a prime has told you verbally that requirements are relaxed, get it in writing before you change anything about your assessment plans. A verbal assurance from a program manager is not a contract modification.

How the three interact

The clauses stack rather than substitute. What DFARS 252.204-7012 requires creates the substantive obligation — protect the data, report incidents. 7019 makes a posted score a condition of eligibility. 7020 lets the government verify independently and makes you verify suppliers. 7021 layers a certification status on top where DoD designates one.

Remove 7021 entirely, as the suspension effectively has for new designations, and you still have every obligation that mattered: implement 800-171, post a defensible score, keep it current, be ready for a government assessment, manage your supply chain. That’s the whole meaning of “suspended is not repealed.”

What to check

1. When was your SPRS score last posted? Approaching three years means it expires whether you’re thinking about it or not.
2. Could you survive a DIBCAC High assessment tomorrow? Not “are we compliant” — could you produce evidence for 320 objectives.
3. Do your CUI-handling subcontractors have current SPRS scores? Have you actually looked?
4. If 7021 is in a live contract, has your CO issued a modification? If not, the clause is still in your contract.
5. Have any primes changed their flowdown in writing? Verbal doesn’t count.

Common questions about DFARS 252.204-7019, 7020 and 7021

What is the difference between DFARS 252.204-7019 and 7020?

7019 is a notice clause making a current SPRS score a condition of eligibility for award. 7020 preserves the government’s right to conduct its own Medium or High assessment of your environment, and separately requires you to verify that CUI-handling subcontractors have their own current scores posted before you award them work.

How current must a SPRS score be under DFARS 252.204-7019?

Not more than three years old. A score posted in year one expires in year four. Contractors typically discover this when a proposal is found ineligible rather than during compliance work.

Is DFARS 252.204-7021 still in effect after the CMMC suspension?

The clause was not repealed. The CMMC program rule at 32 CFR Part 170 and the acquisition rule creating 7021 both remain on the books, and unwinding them would require new rulemaking. What was suspended is DoD’s exercise of discretion in designating CMMC levels and requiring third-party assessments. The clause can still appear in solicitations, and existing contracts containing it need a modification to change.

Does the CMMC suspension apply to prime contractor flowdown requirements?

No. The suspension binds DoD, not primes. A prime managing its own liability may keep certification language in subcontract terms regardless. Confirm any change in writing before altering your assessment plans — a verbal assurance is not a contract modification.

Can DIBCAC still assess us during the CMMC suspension?

Yes. The government’s assessment authority under DFARS 252.204-7020 is entirely unaffected by the Phase 2 suspension. DIBCAC retains full authority to conduct Medium and High assessments.

---

Next step: If question one or two is uncomfortable, score yourself properly first. The SPRS Score Calculator walks all 110 NIST SP 800-171 requirements and gives you a number you can defend. Free, and nothing you enter leaves your browser.

Last reviewed: August 2026. CMMC program status is under review; verify current requirements against official sources before acting.