Clauses · DFARS · Cybersecurity
DFARS 252.240-7997 NIST SP 800-171 DoD Assessment Requirements
Does the regulation require it to flow down?
Yes
Paragraph (g): all subcontracts AND other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items. No dollar threshold. 'Other contractual instruments' is broader than the usual 'subcontracts' formula — it catches teaming instruments and purchase agreements that are not styled as subcontracts.
- Form
- substance, including paragraph (g) itself — self-perpetuating
- Reaches
- all tiers
Checked against acquisition.gov on 2026-08-05 · edition (DEVIATION 2026-O0025)(FEB 2026) — text as published in DoD Class Deviation 2026-O0025, Revision 2, signed 2026-07-16; not in the codified DFARS · base v0.9.3 Read the text ↗
What it makes you produce
2 items for your checklist, slowest first.
A state you have to be in, in a government system
The record has to be posted before the prime can see it, and posting is not the same day as being ready.
- 252.240-7997(d)
A Government Medium or High assessment score, posted to the Supplier Performance Risk System against the system security plan it covered
Owed when your systems are ones 252.204-7012 requires to comply with NIST SP 800-171 ((b)) — no such system in the order, nothing here to assess
Something you write
Days to weeks, and nobody outside your company has to agree to it.
- 252.240-7997(e)(2)
Additional evidence, or a rebuttal of the findings
Owed when an assessment has finished — 14 business days from completion to demonstrate a requirement the team did not observe, or to rebut what it found
When it is used
This clause is NOT in the codified DFARS. It exists only under DoD Class Deviation 2026-O0025, 'Revolutionary FAR Overhaul Part 40, Defense FAR Supplement (DFARS) Part 240' — original signed 2025-12-18 and effective 2026-02-01, Revision 1 signed 2026-06-29, Revision 2 signed 2026-07-16 and effective immediately — which stands up a new DFARS part 240, Information Security and Supply Chain Security, alongside the Revolutionary FAR Overhaul's FAR part 40. Prescribed at deviation 240.370-5(d): insert in all solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for commercial products and commercial services, except those solely for the acquisition of COTS items. No dollar threshold. The clause then narrows itself in paragraph (b): it applies to covered contractor information systems that are required to comply with NIST SP 800-171 in accordance with DFARS 252.204-7012 in the same contract. No 252.204-7012, no covered system, nothing to assess.
Read closely
Paragraph (c) is the duty this clause turns on and it is not a document: access to your facilities, systems and personnel so the Government can run the assessment under 32 CFR 170.24. Both levels are Government-performed, so the self-scored route that used to sit under 252.204-7019 and 252.204-7020 is not in this text. The clause exists only under DoD class deviation 2026-O0025 and is not in the codified DFARS.
The 3 templates that name it, with the line
Source: DoD Class Deviation 2026-O0025, Revision 2, 'Revolutionary FAR Overhaul Part 40, Defense FAR Supplement (DFARS) Part 240', signed 2026-07-16, Attachment A1, 240.370-5(d) and 252.240-7997, obtained from the DFARS Revolutionary FAR Overhaul class deviation index at acq.osd.mil/dpap/dars (verified 2026-08-05); Revision 1 (2026-06-29) and the original (2025-12-18, effective 2026-02-01) also read. Absence from the codified DFARS confirmed against acquisition.gov, which has no 252.240-7997 page and no part 240; absence from the commercial index confirmed against DFARS 212.301(f) and Class Deviation 2026-O0028
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.