Where things stand (October 2026)
- Phase 2 is suspended. On 13 July 2026 the Department of War suspended the November 2026 Phase 2 transition, which was the start of Level 2 (C3PAO) requirements. During the suspension, DoD requirements may designate only CMMC Level 1 (Self) or Level 2 (Self).
- Existing third-party requirements are coming out. DoD has directed contracting officers to remove Level 2 (C3PAO) and Level 3 (DIBCAC) requirements:
- from active solicitations;
- by modification, from existing contracts, before the next option period or during the next scheduled administrative modification.
DoD's current DFARS class deviation is 2026-O0025. Check each modification for the authority it cites.
- The clauses themselves are unchanged.
- DFARS 252.204-7012 still requires NIST SP 800-171, and DoD still enforces Revision 2.
- CMMC levels remain in DFARS 252.204-7021.
- The suspension was made by DoD memo, not by amending 32 CFR Part 170; the eCFR, current to 15 October 2026, shows Part 170 unamended.
- No restart date. As of mid-October 2026, DoD has not announced an end to the Phase 2 suspension. Track changes on our CMMC status page.
DFARS 252.204-7012 in one paragraph
7012 applies to every DoD contract where you process, store or transmit Covered Defense Information (CDI). CDI is unclassified controlled technical information or other CUI that DoD provides to you, or that you develop or handle for DoD in performing the contract. The clause required NIST SP 800-171 to be implemented by 31 December 2017. Today it requires you to:
- Implement the 110 requirements of NIST SP 800-171 on covered systems. DoD currently enforces Revision 2.
- Report cyber incidents to DoD through DIBNet within 72 hours of discovery. You must hold a DoD-approved medium assurance certificate to file.
- Submit any malicious software you isolate to the DoD Cyber Crime Center (DC3).
- Preserve images of affected systems for at least 90 days after you submit the report.
- Make sure any cloud service provider that stores, processes or transmits CDI for you meets security requirements equivalent to the FedRAMP Moderate baseline.
- Flow the clause down to subcontracts that involve CDI or operationally critical support.
7012 itself contains no score. The SPRS score comes from a separate assessment clause, covered below.
DFARS 252.204-7021 in one paragraph
7021 (NOV 2025) is a final clause. It requires you to hold a current CMMC status at the level the contracting officer enters, or higher, for every system that handles FCI or CUI in performing the contract. That status can be a Level 1 or Level 2 self-assessment, a Level 2 C3PAO assessment, or a Level 3 DIBCAC assessment. 7021 means "certification" only when the solicitation asks for a third-party assessment.
Under 7021 you must:
- process, store or transmit FCI/CUI only on systems that have the required status;
- give the contracting officer the CMMC unique identifiers (UIDs) issued by SPRS, and any changes to them during performance;
- enter self-assessment results in SPRS for each UID not covered by a C3PAO or DIBCAC assessment;
- have your affirming official complete the annual affirmation of continuous compliance in SPRS;
- close out a Conditional POA&M to reach Final status;
- flow the clause down, without paragraph (e)(1), to subcontracts involving FCI or CUI, excluding COTS items;
- confirm a subcontractor's CMMC status before you award the subcontract.
Validity:
- Conditional status lasts 180 days.
- Level 1 (Self) is repeated annually.
- Final Level 2 and Level 3 status lasts three years, with an annual affirmation.
7021 does not replace any part of 7012.
How NIST SP 800-171, DFARS 7012, the assessment clause, 7021 and CMMC fit together
| Instrument | What it is | What it requires of you | Where the evidence lives |
|---|---|---|---|
| NIST SP 800-171 (Rev. 2 enforced) | The standard: 110 security requirements for CUI | Implement every requirement; document it in a System Security Plan | SSP, POA&M, evidence against the NIST SP 800-171A assessment objectives |
| DFARS 252.204-7012 | Contract clause: safeguarding and incident reporting | Implement 800-171; report within 72 hours; preserve images for 90 days; submit malware to DC3; cloud at FedRAMP Moderate equivalent; flow down | Contract file, IR plan, DIBNet medium assurance certificate, cloud provider documentation, flowdown records |
| NIST SP 800-171 DoD Assessment clause: 252.204-7019/7020; under the current class deviation, 252.240-7997 | Requires a current NIST SP 800-171 DoD Assessment (Basic, Medium or High) | Post a Basic self-assessment score in SPRS; give DoD access for Medium/High assessments; flow down | SPRS record, score calculated per the DoD Assessment Methodology (how the score works) |
| DFARS 252.204-7021 | Contract clause: CMMC status at a stated level | Hold and maintain current status; report UIDs; annual affirmation; flow down | SPRS CMMC UID, affirmation record, certificate if C3PAO or DIBCAC |
| 32 CFR Part 170 (CMMC Program) | The program rule: levels, assessment types, POA&M rules, phase-in | Meet your level: Level 1 = the 15 FAR 52.204-21 requirements; Level 2 = the 110 of NIST SP 800-171 Rev. 2; Level 3 = Level 2 plus 24 from NIST SP 800-172 | Assessment results; POA&M under 32 CFR 170.21 |
How they fit:
- 7012 sets the obligation.
- The assessment clause scores it.
- 7021 proves it at a level.
- 32 CFR Part 170 defines how that proof works.
Suspending Phase 2 changed how 7021 can be proven. It did not change what 7012 requires. For the standard-versus-program view, see NIST 800-171 vs CMMC.
How the two clauses interact
- 7012 is the technical baseline. NIST SP 800-171 implementation, incident reporting, media preservation.
- 7021 is the proof mechanism.
- The solicitation sets the level and the assessment type: Self, C3PAO or DIBCAC.
- Level 2 can be Self or C3PAO. Level 3 requires DIBCAC.
- While Phase 2 is suspended, Level 2 requirements are limited to Self.
- Both flow down, on different triggers.
- 7012 follows covered defense information (and operationally critical support).
- 7021 follows FCI or CUI.
- A subcontractor that handles only FCI gets 7021 at Level 1 but not 7012.
- 7012 has been enforceable since 2017. Misrepresenting compliance is False Claims Act exposure today, with or without CMMC.
- 7021 is live, but narrowed.
- Phase 1 began 10 November 2025.
- Phase 2, which would have started C3PAO Level 2 requirements on 10 November 2026, is suspended with no restart date.
- Until 9 November 2028, contracting officers include 7021 only where the program office or requiring activity determines that a specific CMMC level is required (DFARS 204.7504(a)(1)).
Which solicitations trigger which
Any DoD contract that involves covered defense information triggers 7012. That has not changed.
7021 is triggered by the clause itself plus the CMMC level and assessment type stated in the solicitation. Since 10 November 2025, 7021 can appear in DoD solicitations involving FCI or CUI. During the suspension, those solicitations can require only Level 1 (Self) or Level 2 (Self). There are no "tiers". 32 CFR 170.3(e) defines four phases, each starting one year after the last, so Phase 4 (full implementation) falls on 10 November 2028. DoD's suspension memo does not say whether the suspension moves that date.
Check the assessment clause number. Under DoD's current class deviation, contracting officers use DFARS 252.240-7997 for NIST SP 800-171 DoD Assessment requirements. Older contracts cite 252.204-7019 and 252.204-7020, and both still appear in the DFARS. Read Sections I and K of every solicitation and modification to see which one you are signing.
Subcontractor flowdown follows the data. If you receive CUI from a prime, you carry the same clause obligations to anyone you share it with. See subcontractor flowdown.
What a contracting officer, prime or assessor will ask you to show
Athena does not assess or certify. This is the evidence that gets asked for, clause by clause, and where it usually breaks.
| Clause / topic | Practice lineage | What gets checked | Common failure |
|---|---|---|---|
| 7012 incident reporting | IR.L2-3.6.2 → NIST SP 800-171 Rev. 2 3.6.2 → 800-171A 3.6.2 | EXAMINE: IR plan naming the DoD reporting path; the DIBNet medium assurance certificate, in hand and current. INTERVIEW: incident lead walks through who files and when the 72-hour clock starts. TEST: tabletop record that exercised a DoD report. | No certificate procured, so the 72-hour clock cannot be met. |
| 7012 cloud | Contract term, 7012(b)(2)(ii)(D) | EXAMINE: for every cloud provider that stores CDI, FedRAMP Moderate (or equivalent) documentation plus a customer responsibility matrix. | A file-sharing or ticketing tool outside the documented boundary is holding CUI. |
| Assessment clause / SPRS | CA.L2-3.12.4 and CA.L2-3.12.2 → 3.12.4, 3.12.2 | EXAMINE: the SPRS score date, the SSP version the score was calculated from, and a POA&M that reconciles to the score. | The SPRS score and the SSP disagree. |
| 7021 status | 7021(d)–(f) | EXAMINE: the CMMC UID(s) mapped to the systems that handle this contract's FCI/CUI; the affirming official's annual affirmation; your record of checking each subcontractor's status before award. | A UID covers an enclave that is not the set of systems actually handling the contract's CUI. |
| POA&M | CA.L2-3.12.2; 32 CFR 170.21 | EXAMINE: each open item is eligible under 170.21, and the closeout date falls within 180 days of the Conditional CMMC Status Date. | Items that can never go on a POA&M are listed anyway, or the 180-day clock is counted from the wrong date. |
POA&M rules in brief (32 CFR 170.21):
- The assessment score must be at least 0.8 of the maximum: 88 of 110 requirements, derived.
- Requirements 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 and 3.10.5 can never be on a POA&M.
- If items are not closed within 180 days, Conditional status expires.
See the POA&M template for the full eligibility rules.
What this means for your program
- If you hold an active DoD contract with CUI, you owe 7012 today. That means:
- a current NIST SP 800-171 DoD Assessment score in SPRS;
- NIST SP 800-171 implemented;
- a 72-hour reporting capability, certificate included.
- Keep a defensible Level 2 self-assessment in SPRS now if you handle CUI: a current score, SSP, POA&M and annual affirmation. Build the evidence to C3PAO standard, so that if Phase 2 restarts you need a scheduling call, not a remediation project. For the Level 1 vs Level 2 split, see CMMC Level 1 vs Level 2 and Level 2 requirements.
- Don't conflate the two. A CMMC status does not relieve you of 7012's incident reporting or media preservation duties. They are independent.
- Document flowdown. Any of these will ask for the subcontractor list with clause flowdown evidence: a contracting officer, a prime, a C3PAO or DIBCAC assessor, or a False Claims Act relator.
- Read every mod. Third-party CMMC requirements in existing contracts can be removed or revised at the next option or administrative modification. Check that your UID and affirmation still match what the contract now requires.
Check your scope before your next mod
Your contract's CMMC requirement can change at the next option or modification. Run the free Scope Check to map which systems touch FCI and CUI under 7012 and 7021. Then get a free Quick Score against the 110 requirements.
Prepared by the Athena Consulting Group CMMC practice. Athena is not a C3PAO and does not certify; this page explains the published rules so you can prepare. Last reviewed 17 October 2026.