whatbindsCheck your order

Clauses · DFARS · Cybersecurity

DFARS 252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements

Does the regulation require it to flow down?

Yes

Whenever the sub processes/stores/transmits FCI or CUI; sub's level per 32 CFR 170.23 (FCI only → L1 self; CUI → minimum L2)

Form
substance (excluding (e)(1))
Reaches
all tiers

Checked against acquisition.gov on 2026-08-09 · edition NOV 2025 · base v0.9.3 Read the text ↗

What it makes you produce

6 items for your checklist, slowest first.

  1. Something somebody else has to issue you2

    The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

    • An assessment by an accredited third-party assessment organization

      Owed when the value written at (d)(1)(i) is CMMC Level 2 (C3PAO). At CMMC Level 1 (Self) or Level 2 (Self) no outside assessor is owed, and Level 3 (DIBCAC) is assessed by the Government

      252.204-7021(d)(1)(i)
    • An affirmation of continuous compliance from each of your own suppliers, and a current certificate or status at the level their work calls for

      Owed when you award a subcontract of your own that will process, store or transmit the information — both are due before that award rather than after it

      252.204-7021(d)(4) and (f)(2)

  2. A state you have to be in, in a government system3

    The record has to be posted before the prime can see it, and posting is not the same day as being ready.

    • A current CMMC status at the level written into the order, or higher, held for the life of the work

      Owed when for every information system used on the work that processes, stores or transmits the information — the level is the value the contracting officer wrote into the blank at (d)(1)(i)

      252.204-7021(d)(1)(i)
    • An affirmation of continuous compliance, completed each year in the Supplier Performance Risk System by a named affirming official

      Owed when for each CMMC identifier covering a system used on the work, and it has to be current rather than merely on file

      252.204-7021(d)(3)
    • The results of a current self-assessment entered in that same system

      Owed when each CMMC identifier not covered by a C3PAO assessment or a DIBCAC assessment

      252.204-7021(e)(2)

  3. Something you write

    Days to weeks, and nobody outside your company has to agree to it.

    • A plan of action and milestones carried through to a close

      Owed when the status on record is Conditional rather than Final

      252.204-7021(d)(5)

When it is used

Contracts (including commercial, except pure COTS) where contractor systems process FCI or CUI, when the CO inserts the required level. Phase 1 (L1/L2 self-assessments) in effect since 2025-11-10.

Read closely

32 CFR 170.23 sets the level a subcontract carries, and it is not always the level of the contract above it. Paragraph (e)(1), the identifiers submitted to the contracting officer, is expressly excluded from what (f)(1) flows down, so that one binds the tier holding the prime contract rather than a supplier under it.

The 11 templates that name it, with the line
2Updates to the November 2024 RTX Flowdown of U.S. Government Contract ClausesRTXline 14166Northrop Grumman CTM-P-ST-001 — U.S. Government Firm Fixed Price Order (Not for Commercial Products and Services)Northrop Grummanline 210569Northrop Grumman CTM-P-ST-002 — U.S. Government FFP or T&M Order for Commercial Products and ServicesNorthrop Grummanline 2199166Northrop Grumman CTM-P-ST-003 — U.S. Government T&M Order (Not for Commercial Products and Services)Northrop Grummanline 2054168Northrop Grumman CTM-P-ST-004 — U.S. Government Cost Reimbursement Order (Not for Commercial Products and Services)Northrop Grummanline 2150255GD Mission Systems SCM-TMP-005 — General Provisions, Firm Fixed Price PO under U.S. Government Contract (Non-Commercial)General Dynamicsline 1260243GD Mission Systems SCM-TMP-048 — T&M Purchase Orders for Non-Commercial Items in Support of a U.S. Government ContractGeneral Dynamicsline 2168122GD Mission Systems SCM-TMP-095 — FFP Purchase Orders for Commercial/COTS Products or Services in Support of a U.S. Government ContractGeneral Dynamicsline 1118240L3Harris LGL-50.F1 — General T&C and Flowdown Clauses for Other Than Commercial Products/Services under a U.S. Government ContractL3Harrisline 2206106L3Harris LGL-50.F2 — General T&C and Flowdown Clauses for Commercial Products/Services under a U.S. Government ContractL3Harrisline 1574273BAE Systems Inc. USGOVA — FAR/DFARS Flow Down Provisions for Subcontracts/Purchase Orders under a U.S. Government (DoD) Prime ContractBAE Systemsline 1135

Source: acquisition.gov, DFARS 252.204-7021; DoD CIO memo 2026-07-13. Codified text read at DFARS Change 5/7/2026, prescribed at 204.7504(a) with designation (NOV 2025). RFO class deviation 2026-O0025 (DFARS part 240, effective 2026-02-01) prints the same designation and prescribes it at 240.371-5(a). The memo itself, Removing Barriers to Defense Industrial Base Expansion, and its Attachment 1 were read at dowcio.war.gov: the memo is signed by Kirsten A. Davies over a signature block that carries no date, and the date it does carry, 2026-07-13, is the open-publication clearance stamp on its face, which is also the announcement date the DoW CIO CMMC page states. Codified text, deviation and memo all read against their primary sources (verified 2026-08-09)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.