Terms / The contract
48 CFR (the DFARS rule)
The acquisition regulations. This is where the clauses live that put NIST SP 800-171 and CMMC into a contract you actually signed.
Also called 48 CFR, DFARS, Defense Federal Acquisition Regulation Supplement.
Practitioner Guidance
What it means in practice
The program rule describes CMMC, and this is where it becomes a contract term.
Title 48 of the Code of Federal Regulations holds the Federal Acquisition Regulation and its supplements. The Federal Acquisition Regulation, the FAR, applies across the Government and contains FAR 52.204-21. The Defense Federal Acquisition Regulation Supplement, the DFARS, adds the DoD clauses numbered 252.204-7012 and above. A requirement only reaches you when a clause from this title is in your contract.
Four clause numbers cover nearly all of this for a small company.
DFARS 252.204-7012 imposes NIST SP 800-171 and cyber incident reporting. DFARS 252.204-7019 conditions your eligibility for award on a current score. DFARS 252.204-7020 keeps that score current and lets the Government assess you. DFARS 252.204-7021 requires a CMMC status. Search your contract for those four numbers. That search tells you more about your obligations than any assessment will.
Read the clause in your contract, not the clause you read last year.
Clauses carry a date in their heading, and that date matters. The CMMC clause in a contract awarded recently reads differently from the version published in 2020. The current 252.204-7021 was published at 90 FR 43575 on September 10, 2025. When you quote an obligation to a customer or a supplier, quote the version in the contract you are performing.
A clause you have not read still binds you.
Contracts incorporate most clauses by reference, which means your contract lists the number and the clause text lives here. Nobody sends you the text. The obligation applies the same way. Pull the numbers from your contract, read each one on the eCFR, and keep a copy in your file.
What falls short
- A compliance program built on the CMMC program rule alone. The rule describes the program, and the clause in your contract creates your obligation.
- A claim that a clause does not apply because you never saw its text. Incorporation by reference is how Federal contracts work.
- A supplier agreement that names CMMC without naming the clause. Flow-down works by inserting the substance of a numbered clause, so the number belongs in the subcontract.
Edge cases
- Your contract includes 252.204-7012 but not 252.204-7021. That is ordinary. The safeguarding obligation applies now, and the CMMC status obligation arrives when the contracting officer includes the clause.
- Your customer is a prime rather than the Government. The clauses reach you through the subcontract, so read the flow-down language there with the same care.
- A clause appears in a solicitation but not the award. Provisions such as 252.204-7019 are written for solicitations and do not appear in the resulting contract.
Over-engineering
- A legal review of every clause in a contract to find your cybersecurity obligations. Searching for 204-7012, 204-7019, 204-7020, 204-7021, and 52.204-21 finds them.
- Tracking the FAR and DFARS in full. Small defense companies need a handful of clauses, and the rest of the title governs how the Government buys.