The DFARS 252.204 cybersecurity clauses do different jobs. Read the clause number, edition, insertion and applicable deviation before deciding what evidence or action is needed. A reference to the family does not establish one universal CMMC requirement.
This map covers five commonly encountered provisions and clauses. It is a reading aid, not a substitute for the text incorporated into your solicitation or contract.
The five-part map
| Reference | Main review question | Record to examine |
|---|---|---|
| 252.204-7012 | What safeguarding, incident-response and flowdown duties apply to covered information and systems? | Incorporated clause, information scope, system security plan and supporting control evidence |
| 252.204-7019 | What current DoD Assessment is required for covered systems relevant to the offer? | Assessment scope, date and summary-score record in SPRS |
| 252.204-7020 | How do the DoD assessment procedures and subcontract conditions apply? | Assessment records, applicable government access and subcontract review |
| 252.204-7021 | Which CMMC status, system scope, affirmation and flowdown requirements apply in performance? | Inserted level, status, UID, affirmation and covered subcontract requirements |
| 252.204-7025 | Which level and representations does this solicitation require? | Populated level insertion, award condition and proposal UID instructions |
Start with the incorporated edition
Today’s official web text is useful for research. It does not prove that the same edition appears in an older contract. Record the date after the clause title, any tailored text, deviation identifier and later amendment.
The standard texts reviewed for this map include 7012 (May 2024), 7019 and 7020 (November 2023), and 7021 and 7025 (November 2025). If your package cites another edition or deviation, obtain that text before applying a paragraph-level instruction.
Separate the assessment score from CMMC status
A Basic NIST SP 800-171 DoD Assessment under 7019/7020 and a CMMC status under 7021/7025 are different records. The current 7019 provision addresses assessment currency, generally not more than three years unless the solicitation specifies a shorter period, for the relevant covered systems.
The November 2025 7021 clause defines currency differently for Final Level 1, Final Level 2/3 and Conditional statuses, and includes affirmation conditions. Do not reduce every status to a three-year certificate rule.
The relevant question is which record the buyer requests for which system at which checkpoint.
Read a blank insertion as an open question
The retained Hellfire RFQ’s 7025 level insertion is blank while other paragraphs contain Level 2 (Self) and different certification terminology. That does not justify choosing one reading silently. Use the clarification guide.
The retained jack-assemblies amendment provides another warning: deleted Level 1 text remains printed in the document. A keyword match finds it, but the amendment heading identifies its role. Review the source-version example.
Apply the suspension through its documents
The July implementation memo directs changes to specified CMMC assessment designations and preserves 7012 requirements. It does not make every clause in this table disappear. Use the pause guide to distinguish the direction from the amendment or modification for a specific procurement.
Turn the reading into assigned work
For each applicable condition, record the source, interpretation, checkpoint, responsible person and supporting evidence in the requirements matrix. Keep unresolved scope and version questions visible.
Deep Fathom can demonstrate compliance assessment and evidence workflows for that work. Review bid requirements. It does not decide the contracting authority’s intended insertion.
Official clause texts rechecked September 13, 2026; retained solicitation examples were reviewed September 7, 2026. The campaign explainer presents the related procurement scenario.