DFARS Amendment Inserting the CMMC Clause into DoD Contracts

Who must comply

Every DoD contractor and subcontractor whose solicitation or contract incorporates the clause under the phased rollout.

What it requires

1. 01Adds DFARS 252.204-7021 to DoD solicitations and contracts on a four-phase schedule beginning November 10, 2025. During the phase-in the clause is used when the program office or requiring activity determines a specific CMMC level is required (DFARS 204.7504(a)(1)), not at contracting officer discretion.
2. 02Phase 1 (from November 10, 2025): DoD intends to require Level 1 (Self) or Level 2 (Self) as a condition of award for all applicable solicitations, and may at its discretion substitute Level 2 (C3PAO) for Level 2 (Self) (32 CFR 170.3(e)(1)). This phase took effect and remains in force.
3. 03Phase 2 (as written, from November 10, 2026): DoD would additionally require Level 2 (C3PAO) as a condition of award for applicable solicitations, and could at its discretion include Level 3 (DIBCAC) (32 CFR 170.3(e)(2)). DoD suspended this phase on July 13, 2026. The November 10, 2026 date is not operative while the suspension is in effect.
4. 04Phase 3 (as written, from November 10, 2027): DoD would require Level 2 (C3PAO) for all applicable awards and option exercises, and would require Level 3 (DIBCAC) as a condition of award (32 CFR 170.3(e)(3)). This phase follows Phase 2, so its timing depends on the outcome of the review DoD opened on July 13, 2026.
5. 05Phase 4 (as written, from November 10, 2028): full implementation. CMMC requirements appear in all applicable DoD solicitations and contracts, including option periods on earlier awards (32 CFR 170.3(e)(4)). Its timing likewise depends on the outcome of the review.

Key points

• Status as of July 13, 2026: DoD suspended CMMC Phase 2 and launched a 60 day top to bottom review of the CMMC program, per a memo signed by DoD Chief Information Officer Kirsten Davies. A CMMC Reform Task Force will submit findings and recommendations within 60 days. Responses to the associated RFI are due by 12pm ET on Friday, August 14, 2026.
• The memo cites prohibitive compliance costs, severe shortages in assessment capacity, and complex regulatory timelines that are actively forcing innovative new entrants and small businesses to opt out of DoD contracts and freezing critical suppliers out of the market.
• Phase 2 is paused, not cancelled. This rule and the 32 CFR Part 170 program rule are both still on the books, and Phase 1, which requires a CMMC self-assessment on applicable contracts, remains in force.
• The suspension does not touch DFARS 252.204-7012. NIST SP 800-171 Rev 2 baseline compliance, DIB self-assessments, and select assessments led by the government continue to be enforced, and False Claims Act exposure for a knowingly false affirmation is unchanged.

Related clauses

• DFARS 252.204-7021
  Cybersecurity Maturity Model Certification Requirements

  DFARS 252.204-7021 is the contract clause that makes a current CMMC certification or self-assessment at the level specified in the contract a material condition of award and continued performance. It triggers the annual senior-official affirmation obligation under 32 CFR 170.22 and is the contractual hook that turns CMMC from a DoD policy into an enforceable requirement.

• 32 CFR 170.15
  CMMC Level 1 Self-Assessment and Affirmation Requirements

  32 CFR 170.15 sets the procedural requirements for CMMC Level 1: an annual self-assessment against the 15 safeguarding requirements of FAR 52.204-21, scored on a binary MET / NOT MET basis with no POA&Ms permitted, followed by an annual affirmation posted in SPRS by the company's Affirming Official.

• 32 CFR 170.22
  Affirmation by a Senior Official

  32 CFR 170.22 requires a named Affirming Official, defined at 32 CFR 170.4 as the senior level representative responsible for ensuring the contractor's compliance with the CMMC Program requirements who has the authority to affirm its continuing compliance, to electronically affirm in SPRS at least every 12 months that the contractor continues to meet the CMMC security requirements for its level. A knowingly false affirmation is the explicit target of the Department of Justice Civil Cyber-Fraud Initiative under the False Claims Act.

Related terms

• 48 CFR CMMC Acquisition Rule
• 32 CFR Part 170
• Cybersecurity Maturity Model Certification

Read more in the Library

• The 48 CFR CMMC Acquisition Rule: What Changes in Your DoD Contracts (2026)

  32 CFR 170 created CMMC. 48 CFR is the rule that puts it into your contract. Here's what to look for in the next solicitation that lands in your inbox.