whatbindsCheck your order

Clauses · DFARS · Cybersecurity · provision

DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements

Does the regulation require it to flow down?

No

N/a — a provision, not a contract clause

A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.

Checked against acquisition.gov on 2026-08-09 · edition NOV 2023 — deleted by class deviation effective 2026-02-01 · base v0.9.3 Read the text ↗

What it makes you produce

2 items for your checklist, slowest first.

  1. A state you have to be in, in a government system

    The record has to be posted before the prime can see it, and posting is not the same day as being ready.

    • An assessment no more than three years old for each covered system relevant to the offer, with its summary level scores posted in the Supplier Performance Risk System

      Owed when you are required to implement NIST SP 800-171 — (b) makes the current assessment a condition of being considered for award, and (c)(1) is the check that the scores are posted

      252.204-7019(b) and (c)(1)

  2. Something you fill in and send back

    Hours, once you know which one is missing.

    • The assessment submission itself — the standard assessed, the CAGE codes covered, the system security plan, the date, the score out of 110, and the date the remaining requirements will be in place

      Owed when no current summary level scores are posted for those systems, which is the route (c)(2) opens

      252.204-7019(d)

When it is used

Solicitation provision (accompanied the 7012, except COTS): required a Basic Assessment ≤ 3 years old posted in SPRS for eligibility.

Read closely

Scores are posted 30 days after the assessment, so the calendar runs from the assessment rather than from the submission. A class deviation effective 2026-02-01 removed this provision from new solicitations; orders written earlier still carry it.

The 6 templates that name it, with the line
255GD Mission Systems SCM-TMP-005 — General Provisions, Firm Fixed Price PO under U.S. Government Contract (Non-Commercial)General Dynamicsline 829243GD Mission Systems SCM-TMP-048 — T&M Purchase Orders for Non-Commercial Items in Support of a U.S. Government ContractGeneral Dynamicsline 1752122GD Mission Systems SCM-TMP-095 — FFP Purchase Orders for Commercial/COTS Products or Services in Support of a U.S. Government ContractGeneral Dynamicsline 885240L3Harris LGL-50.F1 — General T&C and Flowdown Clauses for Other Than Commercial Products/Services under a U.S. Government ContractL3Harrisline 1014106L3Harris LGL-50.F2 — General T&C and Flowdown Clauses for Commercial Products/Services under a U.S. Government ContractL3Harrisline 1028273BAE Systems Inc. USGOVA — FAR/DFARS Flow Down Provisions for Subcontracts/Purchase Orders under a U.S. Government (DoD) Prime ContractBAE Systemsline 1133

Source: acquisition.gov, DFARS 252.204-7019; DoD class deviation 2026-02. Codified provision read at DFARS Change 5/7/2026, prescribed at 204.7304(d) with designation (NOV 2023). RFO class deviation 2026-O0025 (DFARS part 240, effective 2026-02-01) was read in full and carries no successor to this provision: the string 7019 is absent from its 63 pages, and the four insertions 240.370-5 directs are a provision at 252.204-7008, a clause at 252.204-7009, a clause at 252.204-7012 and a clause at 252.240-7997, ending at paragraph (d). DoD_RFO_Deviation_Part-4.pdf answers 404, so DFARS part 204 has no mirrored memo of its own, and that is a gap in the mirror. Both regimes read against their primary sources (verified 2026-08-09)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.