Clauses · DFARS · Cybersecurity · provision
DFARS 252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements
Does the regulation require it to flow down?
No
No mandate: a solicitation provision with no subcontracts paragraph. The subcontract obligation lives in clause 252.204-7021 (already in this base), which flows down in substance to all tiers and makes the prime responsible for its subs holding the right level under 32 CFR 170.23. Primes nevertheless flow 252.204-7025 down — all three GDMS SCM templates (2026-07-20) carry it in the same block as 252.204-7008, -7016, -7017 and the deleted -7019 — because their generated lists are built from the DFARS 212.301(f) index, which does not distinguish provisions from clauses
A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.
Checked against acquisition.gov on 2026-08-05 · edition NOV 2025 · base v0.9.3 Read the text ↗
What it makes you produce
4 items for your checklist, slowest first.
A state you have to be in, in a government system2
The record has to be posted before the prime can see it, and posting is not the same day as being ready.
- 252.204-7025(b)(2)(i)
A current CMMC status at the level the solicitation names, entered in the Supplier Performance Risk System
Owed when for every system that will process, store or transmit the information — the level is the value the contracting officer wrote into the blank at (b)(1)
- 252.204-7025(b)(2)(ii)
A current affirmation of continuous compliance in that same system
Owed when for each of those systems, and it is checked as a condition of being eligible for award
Something you write
Days to weeks, and nobody outside your company has to agree to it.
- 252.204-7025(c)
A plan of action and milestones closed out
Owed when the status on record is Conditional — DFARS 204.7502 gives Conditional Level 2 or 3 a maximum of 180 days
Something you fill in and send back
Hours, once you know which one is missing.
- 252.204-7025(d)
The CMMC unique identifiers issued by the Supplier Performance Risk System, one per assessed system, written into the proposal itself
Owed when the proposal goes in, and again whenever new identifiers are generated during the work
When it is used
Solicitation provision. Goes in every solicitation that includes clause 252.204-7021 (204.7504(b); re-prescribed at 240.371-5(b) by DoD Class Deviation 2026-O0025, effective 2026-02-01) — it never appears alone. 252.204-7021 in turn goes in solicitations, contracts, task orders, and delivery orders including FAR part 12 commercial products and services, except those solely for COTS items, and unless the requirements at 32 CFR 170.5(d) are met: until 2028-11-09 only where the program office or requiring activity determines a specific CMMC level is required; on or after 2028-11-10 wherever contractor information systems will process, store, or transmit FCI or CUI. 32 CFR 170.3 adds an exclusion for procurements at or below the micro-purchase threshold ($15,000) (unconfirmed — read via a CFR mirror on 2026-08-05; eCFR was unreachable and acquisition.gov does not carry title 32).
Read closely
The blank at (b)(1) takes one of four values — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC) — and that value is what decides whether an outside assessor is in the picture at all. Both status rows are checked before award rather than after it, which is why this provision holds an order rather than delaying a deliverable.
The 3 templates that name it, with the line
Source: acquisition.gov, DFARS 252.204-7025, DFARS subpart 204.75 (204.7501-204.7504) and DFARS 212.301(f); DoD Class Deviation 2026-O0025 (acquisition.gov, DoD_RFO_Deviation_Part-40.pdf), DFARS 240.371-1 through 240.371-5 and provision text at Attachment A1; DoD Class Deviation 2026-O0043 (subpart 204.75 reserved); 32 CFR 170.3(e), 170.5(d), 170.21, 170.23, read from a CFR mirror (unconfirmed — eCFR was not the source: ecfr.gov redirects automated retrieval to unblock.federalregister.gov, re-probed 2026-08-09); DoW CIO memo of 2026-07-10 announced 2026-07-13 (secondary reporting only, not on acquisition.gov) (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.