DFARS 252.204-7012: safeguarding covered defense information
Requires adequate security for covered defense information, which means implementing NIST SP 800-171, and reporting cyber incidents to DoD through DIBNet within 72 hours of discovery (252.204-7012).
DFARS 252.204-7019: notice of NIST SP 800-171 DoD Assessment requirements
A solicitation notice: to be considered for award, you need a current NIST SP 800-171 DoD Assessment posted in SPRS, not more than 3 years old (252.204-7019).
DFARS 252.204-7020: NIST SP 800-171 DoD Assessment requirements
The contract clause behind the assessment: you must give the government access for Medium and High assessments, and flow the clause down to subcontractors (252.204-7020). Under DoD's current class deviation, contracting officers may use DFARS 252.240-7997 for this requirement instead; check your contract.
DFARS 252.204-7021: CMMC level requirements
Puts CMMC in the contract: you must hold the CMMC status at the level the contract requires and flow the requirement down (252.204-7021).
DFARS 252.204-7025: notice of CMMC level requirements
A solicitation notice that tells offerors which CMMC level the work requires (252.204-7025).
What to do next
Read Sections I and K of each solicitation. Compare 7012 and 7021, check the current CMMC status, and calculate your SPRS score.