DFARS 252.204-7021 in the FAR overhaul: the same number under the deviation

DFARS 252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements. Same number in the deviation text, as the DoD class deviation lists it; confidence high. As at 27 Sep 2026.

Codified252.204-7021eCFR, clause dated NOV 2025

Under the deviationsame numberClass Deviation 2026-O0025, Revision 3 (DFARS Part 240)

Proposed permanent numberno DFARS proposed rule in the Federal Register

Kept means same number in the deviation text.

Sources last checked 27 Sep 2026 (dataset version 1). What changed and when. An existing contract's clauses are not rewritten by a later deviation or proposed rule; they change only by modification.

What the source says changed

No official source in the set states what changed in the text; the number and title are as listed.

Why this disposition

252.204-7021 appears with its clause text in the DoD RFO class deviation attachment for DFARS Part 240 (Part-240__2026-O0025_Rev3_TAB_A1_DFARS_Part_240); relocated from DFARS part 204 to part 240

Confidence: high. Read from an official table or the deviation or rule text itself.

Titles and where each is prescribed

codified: Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements
under the deviation: Compliance with the Cybersecurity Maturity Model Certification Level Requirements
prescribed at 204.7504(a) (codified); 240.371-5(a) (deviation text)

Which agencies

DoD only. Class Deviation 2026-O0025, Revision 3 (DFARS Part 240), issued 3 September 2026; each DFARS deviation attachment is used in lieu of 48 CFR chapter 2. Confirm which deviation your contracting officer's agency has adopted.

The number is kept in the DFARS Part 240 deviation. Separately, on 13 July 2026 DoD suspended the third-party certification step of the program pending a review; self-assessment against NIST SP 800-171 Rev 2, entry of the result in SPRS and DFARS 252.204-7012 remain in force (DoD CIO, CMMC). This page does not say that certification is required now.

Subcontractors

Tracking which subcontractors have declared a current SPRS assessment for this clause: Subcontractor CMMC Tracker

What flows down

Under the DFARS class deviation: flows down under its own paragraph (f). The Contractor shall- (1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and (2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.
Commercial products and services: not stated in the paragraph. COTS items: excluded. What goes down: the substance of the clause. DoD RFO class deviation file: 2026-O0025_Rev3_TAB_A1_DFARS_Part_240.docx 3 September 2026
Codified text (eCFR): flows down under its own paragraph (f). The Contractor shall- (1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and (2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.
Commercial products and services: not stated in the paragraph. COTS items: excluded. What goes down: the substance of the clause. 48 CFR part 252 (codified DFARS clauses) current to 24 Sep 2026 (issue 18 Sep 2026)

Sources, with their dates

48 CFR part 252 (codified DFARS clauses) current to 24 Sep 2026 (issue 18 Sep 2026), clause dated NOV 2025
DoD RFO class deviation file: 2026-O0025_Rev3_TAB_A1_DFARS_Part_240.docx 3 September 2026

Questions

What is DFARS 252.204-7021 called after the FAR overhaul?

DFARS 252.204-7021 in the FAR overhaul: the same number under the deviation. The codified number is 252.204-7021; the deviation text lists 252.204-7021; no DFARS proposed rule in the Federal Register. As at 27 Sep 2026.

Which number does a contract carry for DFARS 252.204-7021 after the FAR overhaul?

Which number a given contract carries depends on the deviation the contracting agency has adopted and the date of the solicitation or modification. DoD only: Class Deviation 2026-O0025, Revision 3 (DFARS Part 240). Confirm which deviation your contracting officer's agency has adopted.

Is the change to DFARS 252.204-7021 final?

No final FAR overhaul rule had been published in the Federal Register as at 27 Sep 2026. No DFARS proposed rule in the Federal Register.

Read your whole list: run 252.204-7021 in the finder, or paste every clause of a contract, flow-down exhibit or template on the landing page. As at 27 Sep 2026.