Reference · Cybersecurity & CMMC
DFARS 252.204-7020
NIST SP 800-171 DoD Assessment Requirements
DFARS 252.204-7020 is the DoD contract clause requiring a contractor to keep a current NIST SP 800-171 assessment in SPRS, to grant the government access for higher-level assessments, and to ensure its subcontractors have their own current assessments before awarding subcontracts.
What it is
Where 7019 notices the offeror, 7020 is the performance clause. It obligates the contractor to maintain a current SPRS assessment and — for Medium and High assessments — to provide the government access to its facilities, systems, and personnel.
Why it exists
It makes the assessment requirement a continuing contractual obligation and extends it down the supply chain.
Who it applies to
DoD contractors subject to DFARS 252.204-7012, and their subcontractors.
Flow-down
The contractor must include the clause in applicable subcontracts (other than COTS) and must not award a covered subcontract until the subcontractor has a current assessment posted in SPRS.
Compliance triggers
Maintain a current score in SPRS; support DoD Medium/High assessments on request; verify each covered subcontractor's current score before subcontract award; flow the clause down.
Frequently asked
What is the difference between DFARS 7019 and 7020?
7019 is the solicitation provision that notifies offerors they need a current NIST SP 800-171 assessment in SPRS to be eligible for award; 7020 is the contract clause that makes maintaining that assessment — and verifying subcontractors' assessments — an ongoing obligation during performance.
Related terms
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.