FAR and DFARS › DFARS Part 204: Administrative and Information Matters › Subpart 204.75
DFARS 204.7500 Scope of subpart.
The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.
In plain English
This subpart sets out policies and procedures for putting Cybersecurity Maturity Model Certification (CMMC) level requirements into DoD contracts. CMMC is a framework, described in 32 CFR part 170, for assessing a contractor's information security protections. It applies to unclassified contractor information systems and does not replace other security requirements or National Industrial Security Program requirements.
Applies to: DoD contracts involving unclassified contractor information systems
Key terms: Cybersecurity Maturity Model Certification (CMMC) · CMMC level requirements · DoD contracts · unclassified contractor information systems · National Industrial Security Program
Written by AI from this section's text. A guide, not legal advice: the text below rules.
The text
(a) This subpart prescribes policies and procedures for including the Cybersecurity Maturity Model Certification (CMMC) level requirements in DoD contracts. CMMC is a framework (see 32 CFR part 170) for assessing a contractor's information security protections.
(b) This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program.
(c) This subpart applies to unclassified contractor information systems.
← 204.7403 Contract clauses. · 204.7501 Definitions. →
Rule changes for DFARS Part 204
- Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041) ↗ · final rule 2025-09-10 · effective 2025-11-10
- Defense Federal Acquisition Regulation Supplement: Inapplicability of Additional Defense-Unique Laws and Certain Non-Statutory DFARS Clauses to Commercial Item Contracts (DFARS Case 2018-D074) ↗ · final rule 2024-11-15 · effective 2024-11-25
- Defense Federal Acquisition Regulation Supplement; Technical Amendments ↗ · final rule 2024-09-26 · effective 2024-10-01
- Defense Federal Acquisition Regulation Supplement: Data Universal Numbering System to Unique Entity Identifier Transition (DFARS Case 2022-D023) ↗ · final rule 2024-09-26 · effective 2024-10-01
- Defense Federal Acquisition Regulation Supplement: Modification of Notification of Intent To Transport Supplies by Sea (DFARS Case 2020-D026) ↗ · final rule 2024-09-26 · effective 2024-10-01
- Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041) ↗ · proposed 2024-08-15 · comments due 2024-10-15
- Defense Federal Acquisition Regulation Supplement; Technical Amendments ↗ · final rule 2024-07-29 · effective 2024-07-29
- Defense Federal Acquisition Regulation Supplement: Modification of Notification of Intent To Transport Supplies by Sea (DFARS Case 2020-D026) ↗ · proposed 2024-03-26 · comments due 2024-05-28
Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.