CMMCpedia
Work with me

Terms / The contract

DFARS 252.204-7019

The solicitation provision that makes a current NIST SP 800-171 score in SPRS a condition of being considered for award.

Also called 7019, DFARS 7019, Notice of NIST SP 800-171 DoD Assessment Requirements.

Official Source Material

In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order.

Source: 48 CFR 252.204-7019(b), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

This provision decides whether your offer is eligible, not whether you are secure.

DFARS 252.204-7019 appears in the solicitation rather than the awarded contract. It says you cannot be considered for award without a current NIST SP 800-171 score posted in the Supplier Performance Risk System, the DoD database known as SPRS. The bar is that a score exists and is current. No minimum score appears in the provision. A contracting officer who finds nothing in SPRS can set your offer aside without reading it.

Current means not more than three years old.

The provision allows a shorter window when the solicitation names one, so read the solicitation rather than assuming three years. The clock runs from the date you completed the assessment, not from the date you posted it. Check the date in SPRS before you bid. A score that ages out between proposal and award creates a problem you cannot fix quickly.

You post your own score, and the honesty of it matters.

For a Basic Assessment, which is your own review of your system against NIST SP 800-171, you email the summary result for posting to SPRS. You submit the standard against which you assessed, who performed it, the date, the summary score, and the date you expect to reach 110. You also submit the CAGE codes covered, the identifiers the Government assigns to each of your locations. A score you inflate to win work is a false statement to the Government, and the Department of Justice has pursued exactly that under the False Claims Act.

One score per system, not one score per company.

The provision asks for a current assessment for each covered contractor information system relevant to the offer. A company may run a separate enclave for its DoD work and an ordinary network for everything else. That is two systems, and both are described in the system security plan that CA.L2-3.12.4 requires. Decide which system performs the contract before you assess anything, because the scope decision sets what you score.

What falls short

  • A score posted years ago that no longer describes your system. The provision asks for a current assessment, and a rebuild, a migration to a new cloud tenant, or a new office changes what you assessed.
  • A single score covering every CAGE code you hold when the systems differ. The submission names the CAGE codes the system security plan covers, so a shared score must reflect a shared system.
  • A score with no supporting system security plan. The assessment methodology scores requirements described in a plan, and there is nothing to defend later without one.

Edge cases

  • You are a subcontractor and never see the solicitation. Your prime cannot award you work subject to NIST SP 800-171 unless you have completed a Basic Assessment within the last three years, under DFARS 252.204-7020. Post the score before the prime asks.
  • Your score is negative. That is normal arithmetic under the DoD methodology, where each unmet requirement subtracts five, three, or one point from 110. Post the real number and show the plan of action that closes the gap.
  • You perform only work involving Federal Contract Information. The provision applies to offerors required to implement NIST SP 800-171, which follows DFARS 252.204-7012. Confirm in writing which applies before you assess against the wrong standard.

Over-engineering

  • A consultant-run mock assessment before you post anything. A Basic Assessment is a self-assessment by design, and the provision expects you to conduct it.
  • Waiting for a perfect 110 before posting a score. The provision requires a current score, not a passing one, and an unposted score keeps you out of the competition entirely.