SpendQueryBeta

FAR and DFARS › DFARS Part 204: Administrative and Information Matters › Subpart 204.75

DFARS 204.7502 Policy.

The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.

In plain English

This section sets the policy for CMMC requirements in DoD contracts. It says the contracting officer must put the required CMMC level in the solicitation and cannot award to an offeror that lacks a current CMMC status at that level. Contractors must achieve the required CMMC level (or higher) at award and keep it current throughout performance for systems handling FCI or CUI.

Applies to: DoD contracting officers and contractors/offerors on contracts involving FCI or CUI

What it requires

  • Contracting officers must include the required CMMC level in the solicitation if provided by the program office or requiring activity.
  • Contracting officers must not award to an offeror without a current CMMC status at the required level.
  • Contractors must achieve the required CMMC level or higher at time of award for all information systems used in performance that process, store, or transmit FCI or CUI.
  • Contractors must maintain a current CMMC status at the specified level or higher throughout the life of the contract, task order, or delivery order, if required.

Key terms: CMMC level · CMMC status · FCI · CUI · conditional level

Written by AI from this section's text. A guide, not legal advice: the text below rules.

The text

(a) Award eligibility. (1) The contracting officer shall include in the solicitation the required CMMC level, if provided by the program office or the requiring activity.

(2) Contracting officers shall not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status at the CMMC level required by the solicitation.

(3) Contractors are required to achieve, at time of award, a CMMC status at the CMMC level specified in the solicitation, or higher, for all information systems used in the performance of the contract, task order, or delivery order that will process, store, or transmit FCI or CUI. Contractors are required to maintain a current CMMC status at the specified CMMC level or higher, if required by the contract, task order, or delivery order, throughout the life of the contract, task order, or delivery order.

(b) CMMC status. (1) Contracting officers may award a contract, task order, delivery order, or modification to exercise an option or extend a period of performance, if the offeror's or contractor's CMMC status is—

(i) Listed in the definition of “CMMC status”; and

(ii) Equal to or higher than the CMMC level required by the solicitation or contract, task order, or delivery order.

(2) CMMC levels 2 and 3 can be in a conditional level for a period not to exceed 180 days from the CMMC status date (32 CFR 170.21), and award can occur with a conditional CMMC level. CMMC level 1 requires a final CMMC level for award.

← 204.7501 Definitions. · 204.7503 Procedures. →

Rule changes for DFARS Part 204

Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.

DFARS 204.7502 Policy · SpendQuery