Terms / The contract

DFARS 252.204-7021

The contract clause that requires a current CMMC status at the level the contract names, an annual affirmation, and flow-down to subcontracts.

Also called 7021, DFARS 7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements.

Official Source Material

Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ___[Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)] for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

Source: 48 CFR 252.204-7021(d)(1)(i), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

This is the clause that turns CMMC from a program into a contract term.

32 CFR Part 170 describes the CMMC Program. DFARS 252.204-7021 is what puts it in your contract and makes it enforceable against you. The contracting officer writes one of four levels into paragraph (d)(1)(i): Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC). Read that blank first. It tells you whether you assess yourself or pay for an assessment, and the difference is months of work and tens of thousands of dollars.

You must hold the status for the duration of the contract, not just at award.

The clause says have and maintain. A status that lapses mid-performance puts you out of compliance with a contract term while you are still performing. The clause also defines what current means, and the definition is strict. A Conditional status is current for 180 days. A Final Level 1 (Self) status is current for one year, and Final Level 2 and Level 3 for three. Each one needs an affirmation of continuous compliance behind it.

You may only put covered information on systems that carry the required status.

Paragraph (d)(2) limits where the work may happen. If a system processes, stores, or transmits Federal Contract Information or Controlled Unclassified Information, it must hold the status the contract names. A personal laptop, a side mailbox, or a file-sharing account outside your assessed environment is not permitted to touch the work. Decide what is in your environment before the contract starts, then keep the work inside it.

A senior person signs for you every year, and that signature carries personal weight.

Paragraph (d)(3) requires an annual affirmation of continuous compliance in the Supplier Performance Risk System, the DoD database known as SPRS, for each system used in performance. The affirming official is the senior representative responsible for your compliance with the program. The affirmation asserts that your compliance has not changed since the status date. Do not let that signature become a calendar task someone completes without checking.

The clause reaches your suppliers before you award anything.

Paragraph (f) requires you to insert the substance of the clause in subcontracts that will involve this information, including commercial products and services, excluding commercially available off-the-shelf items. Paragraph (f)(2) requires you to confirm your supplier's status before award, at the level appropriate to what you send them under 32 CFR 170.23. This is flow-down, and the clause makes verification your job rather than your supplier's promise.

What falls short

An affirmation signed while you know a requirement has slipped. The affirmation asserts continuous compliance, so a signature over a known gap is a false statement, not paperwork.
A status that covers your main network while the contract work happens in a personal mailbox. Paragraph (d)(2) limits the work to systems holding the required status.
A subcontract awarded on a supplier's verbal assurance. Paragraph (f)(2) asks you to ensure the supplier holds the status before award, and a verbal assurance is not a record.

Edge cases

Your status is Conditional. Paragraph (d)(5) requires you to close out a valid POA&M to reach Final, and the clause treats a Conditional status as current for only 180 days.
The contract names a level higher than you expected. Ask the contracting officer in writing what information drives it. The level should follow the information you will actually handle, and an overstated level is worth raising early.
You run more than one system in performance. The clause works per CMMC unique identifier, so each system that processes, stores, or transmits the information needs its own status and its own affirmation.

Over-engineering

Buying a Level 2 (C3PAO) assessment when the contract names Level 2 (Self). The blank in paragraph (d)(1)(i) governs, and the two differ by a third party and its fee.
Certifying your whole company when one enclave performs the work. The clause reaches the information systems used in performance of the contract, so a smaller assessed environment is both cheaper and easier to defend.

Connects to

32 CFR Part 170 The regulation that creates the CMMC Program: the levels, the assessment types, the scoping rules, and the affirmation you sign each year. The contract
Federal Contract Information (FCI) FCI is information a contract provides to you or generates for the Government that is not for public release. Holding only FCI means CMMC Level 1. What you protect
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
Flow-down Passing a contract requirement to your suppliers. Under 32 CFR 170.23 the CMMC level you flow down depends on what each supplier will handle. The contract
Plan of Action and Milestones (POA&M) A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass. Assessment

Referenced by

32 CFR Part 170 The regulation that creates the CMMC Program: the levels, the assessment types, the scoping rules, and the affirmation you sign each year. The contract
48 CFR (the DFARS rule) The acquisition regulations. This is where the clauses live that put NIST SP 800-171 and CMMC into a contract you actually signed. The contract
Flow-down Passing a contract requirement to your suppliers. Under 32 CFR 170.23 the CMMC level you flow down depends on what each supplier will handle. The contract
Prime contractor The company holding the contract directly with the Government. It owns the CMMC obligation for the whole supply chain beneath it. The contract
C3PAO A CMMC Third-Party Assessment Organization. It is the company that performs a Level 2 certification assessment and charges you for it. Assessment
Self-assessment An assessment you conduct on your own system. It carries the same requirements as a certification assessment and the same legal weight. Assessment
CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Final certification The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3. Certification
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification