CMMCpedia
Work with me

Terms / The contract

DFARS 252.204-7020

The clause that keeps your NIST SP 800-171 score in SPRS, lets the Government assess you, and blocks subcontract awards without a score.

Also called 7020, DFARS 7020, NIST SP 800-171 DoD Assessment Requirements.

Official Source Material

The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment Methodology at https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf, if necessary.

Source: 48 CFR 252.204-7020(c), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

This clause is the one that lets the Government come and look.

DFARS 252.204-7019 asks for a score before award. DFARS 252.204-7020 lives in the awarded contract. It requires you to give the Government access to your facilities, your systems, and your people, so it can conduct a Medium or High assessment. A Medium assessment reviews your documents. A High assessment verifies, examines, and demonstrates that what your system security plan claims is actually running. The Defense Contract Management Agency performs these through its Defense Industrial Base Cybersecurity Assessment Center.

The clause applies wherever NIST SP 800-171 applies.

Paragraph (b) ties it to covered contractor information systems required to comply with NIST SP 800-171 under DFARS 252.204-7012. The three clauses work as a set. 7012 imposes the standard, 7019 conditions your offer on a score, and 7020 keeps the score current and the Government able to check it.

You cannot award a subcontract to a supplier with no score.

Paragraph (g) forbids you from awarding a subcontract subject to NIST SP 800-171 unless that supplier has completed at least a Basic Assessment within the last three years. A Basic Assessment is a supplier's own review of its system against the standard. It also requires you to pass the substance of the clause down, including to subcontracts for commercial products and services, excluding commercially available off-the-shelf items. A prime contractor that skips this check has a compliance gap of its own, not just a risky supplier.

You get to rebut a Government score before it posts.

Paragraph (e) requires DoD to give you the Medium or High summary score before it is posted. You get an opportunity for rebuttal and adjudication first. The score then goes into the Supplier Performance Risk System, the DoD database known as SPRS. Use it. Read the findings against your system security plan and your evidence, and answer in writing where the assessor misread what you implemented. A posted score follows you for three years.

What falls short

  • A subcontract awarded to a supplier whose SPRS score you never checked. Paragraph (g) makes the check yours, and a missing score is a bar to award, not a risk you may accept.
  • An assessment scheduled with no evidence assembled. A High assessment verifies implementation, so screenshots, configuration exports, and signed policies must exist before the team arrives.
  • A refusal to give assessors access to an outsourced environment. The clause asks for access to facilities, systems, and personnel, and a managed service provider contract that blocks it is a contract you need to change.

Edge cases

  • Your system runs entirely in a cloud tenant a provider manages. You still owe access, so your agreement with that provider must let the Government examine the parts of the environment your score covers.
  • The Government assesses you and scores you lower than you self-scored. The rebuttal path in paragraph (e) comes first, and the corrected plan of action comes second. Both belong in your file.
  • A supplier gives you a score by email rather than posting it. The clause points to SPRS, and paragraph (g)(3) tells a supplier without a posted score how to submit one. Ask for the posting, not the email.

Over-engineering

  • Preparing for a High assessment on every contract. Medium and High assessments are conducted where DoD decides they are warranted, and your first obligation is an accurate self-assessment.
  • A supplier portal built to collect scores from every vendor you buy from. The check applies to subcontracts subject to NIST SP 800-171, not to the company that services your printers.