Reference · Cybersecurity & CMMC
DFARS 252.204-7021
Cybersecurity Maturity Model Certification Requirements
DFARS 252.204-7021 is the DoD contract clause that makes CMMC a condition of award and performance: the contractor must hold a current CMMC certificate at the level the contract specifies, maintain it throughout, and flow the requirement down to subcontractors.
What it is
The clause ties a specific CMMC level to the contract. The contractor must have achieved, and must maintain, the required CMMC certificate for the duration of performance.
Why it exists
It is the contractual hook that operationalizes the CMMC program — without it in the contract, CMMC certification is not a requirement of that award.
Who it applies to
DoD contractors and subcontractors on contracts that include the clause, once CMMC is phased into procurements.
Flow-down
The prime must flow the requirement down to subcontractors at a CMMC level appropriate to the information the subcontractor will handle.
Compliance triggers
Achieve the required CMMC level (self-, C3PAO-, or government-assessed depending on level) before award; maintain it during performance; ensure subcontractors hold the appropriate level.
Regulatory dates and requirements in this area change. Confirm the current guidance against the official sources below before you rely on it.
Frequently asked
What does DFARS 252.204-7021 require?
It requires the contractor to hold a current CMMC certificate at the level the contract specifies and to maintain it throughout performance. The required level and its phase-in are set by the contract and the CMMC rule.
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.