DFARS 252.204-7019 vs 7020 vs 7021: What Each Clause Triggers

DFARS 252.204-7019, 7020 and 7021 arrived together, sit next to each other in solicitations, and get treated as one requirement. They aren’t. They do three different jobs, they bind different parties, and after the CMMC Phase 2 suspension they sit in three different states. For how these fit with 7012 and FAR 52.204-21, start with DFARS and FAR Cybersecurity Clauses: What Each One Actually Requires.

One line each:

• 7019 — you must have posted a score to be eligible for award
• 7020 — the government can come check, and you must verify your subs
• 7021 — you must hold a CMMC status and affirm it annually

DFARS 252.204-7019: the eligibility gate

This is a notice clause, which is why it’s easy to skim past. It tells offerors that to be considered for award, they must have a current NIST SP 800-171 DoD Assessment on record in the Supplier Performance Risk System.

Current means not more than three years old. That’s the trigger nobody diaries. A score posted in year one quietly expires in year four, and contractors discover it when a proposal is found ineligible — not while doing compliance work. Score expiry belongs on your list of trigger events alongside contract award and prime changes.

The score comes from the DoD Assessment Methodology: start at 110, deduct 5, 3, or 1 point per unimplemented requirement, floor at -203. Negative scores are normal early on and not disqualifying by themselves.

What matters is that a score exists, that it’s current, and — increasingly — that it’s defensible. A contracting officer can see your score before award. So can a prime evaluating you as a supplier. A score you can’t substantiate is worse than a low score you can, because the low score is a starting position and the unsupportable one is a representation.

DFARS 252.204-7020: the government’s right to check

7020 does two distinct things, and most contractors only know the first.

It preserves the government’s assessment authority. DoD may conduct a Medium or High assessment of your environment. In practice that’s DIBCAC, and a High assessment is an on-site review of evidence against all 320 objectives. This authority is entirely unaffected by the CMMC suspension.

It makes you responsible for your subcontractors’ scores. Before awarding a subcontract to a supplier that will handle CUI, you must ensure that supplier has its own current assessment posted in SPRS.

That second obligation is an active verification duty, not a paperwork one. Flowing the clause down does not satisfy it — you have to confirm the score is actually there. Primes who assume the clause does the work carry a gap they don’t know about. Flowdown: which clauses you must pass to your subcontractors covers how to run that check, and vendor and partner selection covers what to do when a supplier’s score is a problem.

DFARS 252.204-7021: the CMMC clause, and where it stands

7021 attaches a CMMC level to a specific contract. Where DoD designates a level, you must hold that status or higher at award, maintain it for the duration, and complete an annual affirmation of continuing compliance through a named affirming official.

On July 13, 2026, DoD suspended CMMC Phase 2, including the November 10, 2026 milestone that would have made third-party C3PAO assessments mandatory for most Level 2 contracts.

What that did and did not do:

The clause was not repealed. The CMMC program rule at 32 CFR Part 170 and the acquisition rule creating 7021 both went through full notice-and-comment rulemaking and remain on the books. Unwinding them would require new rulemaking. What was suspended is the department’s exercise of discretion in designating levels and requiring certification assessments. As of the suspension, 7021 was listed as “TBD” on DoD CIO’s CMMC resources page.

The clause can still appear in solicitations. If you hold a contract with a 7021 certification condition, expect a modification. If you’re mid-proposal on a solicitation that required certification, expect an amendment. Neither is automatic — see a clause in a contract you already signed for how to handle the first case.

Existing certifications still count. 7021 permits a higher certification level to satisfy a lesser designation, so a completed Level 2 certification remains valid and remains a differentiator with primes and in M&A diligence.

Phase 1 self-assessments continue. Level 1 and Level 2 self-assessment requirements were never suspended, and neither were the annual affirmations attached to them.

The part that catches subcontractors

The suspension binds DoD. It does not bind your prime.

7021 requires primes to flow down the substance of CMMC requirements. A prime managing its own liability may well keep certification language in subcontract terms regardless of what DoD paused — and it is entirely within its rights to do so.

Relief does not flow downhill automatically. If a prime has told you verbally that requirements are relaxed, get it in writing before you change anything about your assessment plans. A verbal assurance from a program manager is not a contract modification.

How the three interact

The clauses stack rather than substitute. What DFARS 252.204-7012 requires creates the substantive obligation — protect the data, report incidents. 7019 makes a posted score a condition of eligibility. 7020 lets the government verify independently and makes you verify suppliers. 7021 layers a certification status on top where DoD designates one.

Remove 7021 entirely, as the suspension effectively has for new designations, and you still have every obligation that mattered: implement 800-171, post a defensible score, keep it current, be ready for a government assessment, manage your supply chain. That’s the whole meaning of “suspended is not repealed.”

What to check

1. When was your SPRS score last posted? Approaching three years means it expires whether you’re thinking about it or not.
2. Could you survive a DIBCAC High assessment tomorrow? Not “are we compliant” — could you produce evidence for 320 objectives.
3. Do your CUI-handling subcontractors have current SPRS scores? Have you actually looked?
4. If 7021 is in a live contract, has your CO issued a modification? If not, the clause is still in your contract.
5. Have any primes changed their flowdown in writing? Verbal doesn’t count.