Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements
A contract clause under the Defense Federal Acquisition Regulation Supplement, placed in Uniform Contract Format Section I (Contract clauses).
When it applies
Required by DFARS 204.7504(a) in DoD solicitations and contracts (including FAR part 12 commercial, except COTS-only) when the requiring activity determines a CMMC level is required — the contractor must have and maintain the specified CMMC level for systems handling FCI/CUI.
Prescription
The DFARS directs use of 252.204-7021 at 204.7504(a) — read the prescribing section on acquisition.gov →.
Official text
The full, authoritative text of 252.204-7021 is on acquisition.gov: View DFARS 252.204-7021 →
Frequently asked questions
When does DFARS 252.204-7021 apply?
Required by DFARS 204.7504(a) in DoD solicitations and contracts (including FAR part 12 commercial, except COTS-only) when the requiring activity determines a CMMC level is required — the contractor must have and maintain the specified CMMC level for systems handling FCI/CUI.
Where is DFARS 252.204-7021 prescribed?
The DFARS prescribes 252.204-7021 at 204.7504(a). ArcClause selects it automatically when your acquisition triggers that prescription.
Is DFARS 252.204-7021 a solicitation provision or a contract clause?
252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, is a contract clause under the Defense Federal Acquisition Regulation Supplement.
Is DFARS 252.204-7021 incorporated by reference or set out in full text?
252.204-7021 is typically incorporated by reference in the contract.
Where can I read the official text of DFARS 252.204-7021?
The full, authoritative text of 252.204-7021 is published on acquisition.gov.
How do I know which clauses apply to my acquisition?
ArcClause builds a complete FAR/DFARS clause matrix for your acquisition automatically — enter your parameters and it selects every applicable provision and clause, including 252.204-7021 when triggered. It is free to use at https://www.aframesolutions.com/arcclause.
Which clauses does your solicitation need?
Answer a short wizard and ArcClause builds your full FAR & agency-supplement matrix, with the prescription behind every row, aware of both the legacy FAR and the FAR Overhaul deviations your agency has adopted. Get it emailed to you as Word & Excel. Free, no login.