whatbindsCheck your order

Clauses · DFARS · Cybersecurity

DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements

Does the regulation require it to flow down?

Yes

All subcontracts, including commercial, except COTS — and the prime is PROHIBITED from awarding to a sub without a current assessment in SPRS

Form
substance
Reaches
all tiers

Checked against acquisition.gov on 2026-08-09 · edition NOV 2023 — renumbered 252.240-7997 by deviation for new contracts (2026-02-01) · base v0.9.3 Read the text ↗

What it makes you produce

2 items for your checklist, slowest first.

  1. Something somebody else has to issue you

    The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

    • The same completed assessment from each of your own suppliers, before anything is awarded to them

      Owed when you place a subcontract of your own that is subject to NIST SP 800-171 under 252.204-7012

      252.204-7020(g)(2)

  2. A state you have to be in, in a government system

    The record has to be posted before the prime can see it, and posting is not the same day as being ready.

    • An assessment of your covered systems completed inside the last three years, with the summary level scores posted in the Supplier Performance Risk System

      Owed when the subcontract is subject to NIST SP 800-171 under 252.204-7012 — (g)(2) bars the tier above from awarding until the assessment is done, and (g)(3) is the route to get the score posted

      252.204-7020(g)(2) and (g)(3)

When it is used

Contracts with systems covered by the 7012.

Read closely

Paragraph (c) carries a duty no checklist can show as a deliverable: access to your facilities, systems and personnel while the Government runs a Medium or High assessment. A class deviation effective 2026-02-01 renumbered this clause to 252.240-7997 and dropped the self-scored Basic assessment; orders written before that still carry this text.

The 15 templates that name it, with the line
76CORPDOC 2A — FAR/DFARS Flowdown Provisions for Commercial Products/Services under a DoD Prime ContractLockheed Martinline 141143CORPDOC 3A — FAR/DFARS Flowdown Provisions for Fixed Price Non-Commercial Items under a DoD Prime ContractLockheed Martinline 353155CORPDOC 4A — FAR/DFARS Flowdown Provisions for Cost-Reimbursement/T&M Subcontracts under a DoD Prime ContractLockheed Martinline 393233RTX Flowdown of U.S. Government Contract Clauses Under U.S. Government ContractsRTXline 662166Northrop Grumman CTM-P-ST-001 — U.S. Government Firm Fixed Price Order (Not for Commercial Products and Services)Northrop Grummanline 241269Northrop Grumman CTM-P-ST-002 — U.S. Government FFP or T&M Order for Commercial Products and ServicesNorthrop Grummanline 2396166Northrop Grumman CTM-P-ST-003 — U.S. Government T&M Order (Not for Commercial Products and Services)Northrop Grummanline 2344168Northrop Grumman CTM-P-ST-004 — U.S. Government Cost Reimbursement Order (Not for Commercial Products and Services)Northrop Grummanline 2442255GD Mission Systems SCM-TMP-005 — General Provisions, Firm Fixed Price PO under U.S. Government Contract (Non-Commercial)General Dynamicsline 1259243GD Mission Systems SCM-TMP-048 — T&M Purchase Orders for Non-Commercial Items in Support of a U.S. Government ContractGeneral Dynamicsline 2167122GD Mission Systems SCM-TMP-095 — FFP Purchase Orders for Commercial/COTS Products or Services in Support of a U.S. Government ContractGeneral Dynamicsline 1117240L3Harris LGL-50.F1 — General T&C and Flowdown Clauses for Other Than Commercial Products/Services under a U.S. Government ContractL3Harrisline 1015106L3Harris LGL-50.F2 — General T&C and Flowdown Clauses for Commercial Products/Services under a U.S. Government ContractL3Harrisline 1029273BAE Systems Inc. USGOVA — FAR/DFARS Flow Down Provisions for Subcontracts/Purchase Orders under a U.S. Government (DoD) Prime ContractBAE Systemsline 1134107Honeywell — Supplemental Provisions Under Fixed Price U.S. Government Contracts for Commercial ItemsHoneywellline 563

Source: acquisition.gov, DFARS 252.204-7020; DoD class deviation 2026-02. Codified text read at DFARS Change 5/7/2026, prescribed at 204.7304(e) with designation (NOV 2023). RFO class deviation 2026-O0025 (DFARS part 240, effective 2026-02-01) carries the same clause renumbered 252.240-7997, prescribed at 240.370-5(d) and designated in that memo as (DEVIATION 2026-O0025)(FEB 2026), in that order and once only. THE MEMO MISCITES ITSELF TWICE ON THAT SECTION: 240.370-5 runs (a) through (d) and stops, and (d) is the paragraph that directs insertion of 252.240-7997, yet the clause head printed later cites 240.370-5(e), a paragraph the section does not contain, and the head for 252.204-7009 cites 240.370.5 with a period where every other citation in the memo prints a hyphen. The prescription a contracting officer works from is (d). DoD_RFO_Deviation_Part-4.pdf answers 404, so DFARS part 204 has no mirrored memo of its own, and that is a gap in the mirror. Both regimes read against their primary sources (verified 2026-08-09)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.