Critical RiskDFARSCybersecurity

252.204-7021 — Cybersecurity Maturity Model Certification Requirements

Researched by the BidStride Research Team

What This Clause Requires

Requires contractor to maintain the CMMC level specified in the solicitation and have a current certification on record in SPRS. CMMC Level 2 requires a third-party assessment by a C3PAO.

Official Regulation Text

See 48 CFR 252.204-7021 for the full regulatory text.

Source: eCFR, 48 CFR 252.204-7021

Compliance Checklist

  • Achieve and maintain the CMMC level specified in the contract (1, 2, or 3)
  • CMMC Level 2: obtain certification from a DoD-approved C3PAO
  • CMMC Level 3: obtain certification from DCSA
  • Post CMMC certification status to SPRS
  • Maintain CMMC certification for duration of contract
  • Flow down appropriate CMMC level to all subcontractors handling CUI

Flow-Down to Subcontractors

Flow-down required

This clause must be included in subcontracts with all subcontractors at all tiers where the subcontractor will perform work covered by this clause. Typically appears in contract Sections H, I, L, M.

BidStride automatically scans your RFPs for 252.204-7021

Stop hunting through solicitations manually. BidStride identifies every FAR and DFARS clause in your RFP, flags risk level, and surfaces compliance requirements before you submit your bid.

This summary is for informational purposes only and reflects the BidStride Research Team's plain-English interpretation of the regulation. It is not legal advice and does not constitute an attorney-client relationship. Always consult the official Federal Acquisition Regulation (FAR) or Defense Federal Acquisition Regulation Supplement (DFARS) text and qualified legal counsel for compliance decisions.