DFARS 7021: What the CMMC Clause Requires

DFARS 252.204-7021 is the Department of Defense contract clause that turns a Cybersecurity Maturity Model Certification (CMMC) level into a contract obligation. If the clause is in your award or subaward, you must hold a current CMMC status at the level the contracting officer specifies, keep it current with annual affirmations in the Supplier Performance Risk System (SPRS), and pass the requirement down to subcontractors. This guide walks through the clause paragraph by paragraph, as described on the official page on 2026-10-29, and shows what a sponsored programs or research security office has to do with each one. For the CMMC levels themselves, see the linked CMMC guides.

What DFARS 252.204-7021 is and who runs it

The official title is “252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements,” dated NOV 2025 on acquisition.gov, where it is prescribed at DFARS 204.7504(a). The clause sits in the Defense Federal Acquisition Regulation Supplement, which the Department of Defense issues. The CMMC program it points to is defined in 32 CFR part 170, and results are recorded in SPRS, which is reached through the PIEE portal (piee.eb.mil).

The clause is the contract-side half of CMMC. The program rule says how assessments work; the clause says that a contractor must have the result. The overview of CMMC for universities and research institutions covers the program rule and rollout, and CMMC compliance for research institutions covers the institutional side.

Eligibility: when the clause applies to you

There is no application. The clause applies when the contracting officer includes it in a DoD solicitation and contract, and it matters to any entity whose information systems handle federal contract information (FCI) or controlled unclassified information (CUI) under that contract. The companion solicitation provision, 252.204-7025, is where the contracting officer fills in the required level (see the table below). The official sources are the clause page at acquisition.gov and 32 CFR part 170.

Three definitions in paragraph (a) decide most questions about scope:

FCI is non-public information provided or generated under a contract. The clause excludes public information and simple transactional data such as payment processing.
CUI is government-related information that needs safeguarding or dissemination controls, with the definition tied to 32 CFR 2002.4(h). Our guide on who is responsible for CUI compliance at a university explains how that lands on campus.
CMMC status is the result of meeting the minimum score, one of seven statuses: Final Level 1 (Self); Conditional or Final Level 2 (Self); Conditional or Final Level 2 (C3PAO); and Conditional or Final Level 3 (DIBCAC).

What the clause requires, paragraph by paragraph

Paragraphs (a) to (c): definitions, framework and no duplication

Paragraph (a) defines the terms above plus “current,” the CMMC unique identifier (UID) and the plan of action and milestones (POA&M). Paragraph (b) says CMMC is the framework for assessing contractor compliance with information security protections under 32 CFR part 170. Paragraph (c) says CMMC assessments should not duplicate comparable DoD assessments, except in rare cases such as signs of a cybersecurity problem.

What “current” means

The definition of “current” sets age limits. Conditional Level 2 and Conditional Level 3 statuses expire after 180 days, and Final Level 1 status and affirmations after one year. Final Level 2 and Final Level 3 statuses last three years, with affirmations renewed yearly. Any change in compliance breaks currency. The definition cites 32 CFR 170.15 to 170.18 and 170.22.

Paragraph (d): the core obligations

Paragraph (d) is where the duties sit. As described on the official page, the contractor must:

Maintain a current CMMC status at the level the contracting officer specifies, for all information systems that handle FCI or CUI under the contract.
Process, store or transmit FCI or CUI only on contractor information systems that have the required CMMC status or higher.
Submit an annual affirmation of continuous compliance in SPRS for each applicable CMMC UID.
Make sure subcontractors affirm compliance before subcontract award and annually afterward.
Close out a valid POA&M if the status is Conditional, so that it can become Final (see 32 CFR 170.21).
Flow down the correct level to subcontracts, as set out in 32 CFR 170.23.

Paragraph (e): UIDs and SPRS entries

Paragraph (e) deals with reporting: giving the contracting officer the UIDs for the relevant systems and any changes, entering self-assessment results in SPRS where no C3PAO or DIBCAC assessment applies, and completing annual affirmations for each assessment. A UID is ten alphanumeric characters assigned per assessment and recorded in SPRS, so a campus with several assessed enclaves can hold several UIDs.

Paragraph (f): subcontracts

Paragraph (f) requires the clause in subcontracts that involve FCI or CUI, including subcontracts for commercial products and services, but not for commercially available off-the-shelf (COTS) items. Paragraph (e)(1) is omitted from the flowdown. Before award, the prime must ensure the subcontractor has a current CMMC certificate or current CMMC status at the appropriate level. For a university issuing subawards, that check belongs before the subaward is signed, not at the first invoice.

Compliance steps for a research office

Read the solicitation first. Find which level the contracting officer entered in 252.204-7025 and note the scope of systems that will handle FCI or CUI.
Map the systems. Decide which information systems actually process, store or transmit that information, since paragraph (d) ties the required status to those systems and forbids using systems below the level.
Get the status. Level 1 and self-assessed Level 2 results are entered in SPRS; C3PAO and DIBCAC statuses come from those assessments. See CMMC Level 1 self-assessment, CMMC Level 2 assessment and the SPRS score and NIST 800-171 self-assessment.
Record the UIDs that SPRS issues and give them to the contracting officer, as the proposal provision and paragraph (e) require.
Calendar the affirmations. One per applicable UID per year, plus any Conditional-status POA&M deadline.
Flow down. Insert the clause in qualifying subawards, exclude COTS items, and confirm each subrecipient’s status before award.

The technical controls behind Level 2 are covered in NIST SP 800-171 for university CUI.

Typical timeline phases

The clause appears in contracts on a phased schedule. Under 32 CFR 170.3(e), Phase 1 begins on the effective date of the complementary 48 CFR part 204 CMMC acquisition final rule. Phase 2 begins one calendar year after Phase 1 starts, and Phases 3 and 4 each begin one calendar year after the prior phase. At Phase 4, the rule states that DoD will include CMMC Program requirements in all applicable DoD solicitations and contracts. Within a single award the order is: level named in the solicitation, status in SPRS before award, UIDs listed in the proposal, annual affirmations during performance, and re-assessment when a status ages out under the “current” definition.

Common mistakes

Treating the clause as a one-time certificate. Paragraph (d) requires annual affirmations in SPRS for each UID, and any change in compliance breaks currency.
Using a lower-level system for covered information. The clause requires FCI and CUI to stay on systems at the required level or higher.
Forgetting subawards. The clause flows down to subcontracts involving FCI or CUI, and the prime must confirm status before award.
Letting a Conditional status lapse. Conditional Level 2 and Level 3 statuses expire after 180 days, so the POA&M has to close first.
Confusing the clause with the provision. 7025 is where the level is chosen and the offeror lists UIDs; 7021 is the performance obligation.

Related clauses and programs

Clause or program	What it does	Official source
DFARS 252.204-7025	Solicitation provision. The contracting officer names one of four level designations: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). The offeror needs a current status in SPRS at that level or higher, a current affirmation of continuous compliance, and must list the UIDs in the proposal.	acquisition.gov (checked 2026-10-29)
DFARS 252.204-7019 and 252.204-7020	Solicitation provision and contract clause on NIST SP 800-171 DoD assessments. The offeror must have current summary-level scores posted in SPRS, and the assessment must be not more than three years old unless the solicitation specifies a shorter time.	acquisition.gov (checked 2026-10-29)
DFARS 252.204-7012	Contract clause on safeguarding covered defense information and cyber incident reporting; it requires covered contractor information systems to meet NIST SP 800-171. See NIST SP 800-171.	acquisition.gov (checked 2026-10-29)
32 CFR part 170	The CMMC program rule: assessment types, POA&M (170.21), affirmation (170.22), flowdown (170.23), phase-in (170.3).	govinfo.gov (checked 2026-10-29)

FAQ

What is DFARS 252.204-7021?

It is the DoD contract clause that requires a contractor to hold a current CMMC status at the level the contracting officer specifies and to affirm continuous compliance annually in SPRS.

Does 7021 apply to subcontractors?

Yes. Paragraph (f) requires the clause in subcontracts that involve FCI or CUI, including commercial products and services, but not COTS items, and the prime must confirm current status before award.

How often must compliance be affirmed?

Annually, for each applicable CMMC UID, in SPRS. Subcontractors affirm before award and annually afterward.

What happens with a Conditional status?

The contractor must close out a valid POA&M to move to Final status. Conditional Level 2 and Level 3 statuses expire after 180 days.

What is the difference between 7021 and 7025?

7025 is the solicitation provision where the level is designated and the offeror shows its status and UIDs. 7021 is the contract clause that carries the obligation through performance.