DFARS 252.204-7019 and -7020: the SPRS score clauses

A notice and a clause: what each one does

To be considered for award, a contractor bound by 800-171 needs a current assessment (not more than 3 years old) with its summary score posted in SPRS; a Basic Assessment is the contractor's own self-assessment, scored by the DoD Assessment Methodology. Two DFARS texts carry that rule, and they arrive at different moments. You meet 252.204-7019 in the bid package; you sign 252.204-7020 with the contract. Both are dated (NOV 2023).

The trigger for both is the same: your systems hold covered defense information, so DFARS 252.204-7012 already puts NIST SP 800-171 on them (what that clause asks is in DFARS 252.204-7012 explained). DFARS 204.7302(a)(2) says it plainly from DoD's side: contractors required to implement 800-171 must have, at the time of award, at least a Basic Assessment that is current. A shop that only handles federal contract information, with no CUI, is outside both texts; its rule is the Level 1 list in CMMC Level 1 requirements.

Basic, Medium and High: who scores you

The two clauses name three kinds of NIST SP 800-171 DoD Assessment. They differ in who does the looking and how far the looking goes, and 7020 grades each by the confidence DoD can put in the number it produces.

You choose to do a Basic Assessment. You do not choose a Medium or a High: under 7020(c) you must give access to your facilities, systems and personnel when the Government needs it to run one, “if necessary”. DFARS 204.7302(a)(5) adds a limit on DoD's side: these assessments will not duplicate another DoD assessment or CMMC, except in rare cases such as changed risks or threats.

When one happens, DoD gives you the summary score first and offers rebuttal and adjudication before posting it. After each assessment you have 14 business days to show that you meet a requirement the team did not see, or to rebut a finding (7020(e)(2)). A High Assessment may produce more paperwork than the score; DoD keeps it as CUI for internal use (7020(f)(3)).

What a Basic Assessment posting carries

Under DFARS 252.204-7019 a Basic Assessment posts its summary score (e.g., 95 out of 110) and the date by which all requirements are expected to be implemented, that is, a score of 110. The clause lists six items in all, and 7020(d)(1) describes the submission as an encrypted email of the summary scores for posting to SPRS. How the entry is made in practice, through PIEE, is in how to submit an SPRS score.

Fig. 02

Two of the six trip shops up. First, (C): a Basic Assessment's email lists, for each system security plan, every CAGE code associated with the systems it covers. A shop with a second plant under its own CAGE code, or a cloud enclave under a different plan, posts each plan with its own codes, so every CAGE code relevant to a bid has a score behind it. Second, (F): the date for 110 comes from your plans of action, so a score below 110 with no plan of action behind it has no honest date to post. The plan itself is explained in what is a POA&M.

For a Medium or High, DoD posts the same kind of summary itself: the standard, the organization that assessed you (DCMA or another DoD activity named by its DoDAAC), your CAGE codes, the date and level, the score and the date for 110 (7019(d)(2)). Scores in SPRS are available to DoD personnel and protected under DoD Instruction 5000.79, and your own authorized representatives can view yours (7019(d)(3)).

The 3-year clock, and when DoD reads it

A score in SPRS does not last for ever. The provision counts its age from the date the assessment was completed, item (D) on the posting, and gives the solicitation room to ask for a fresher one:

The age matters on more than one day. DFARS 204.7303(b) has the contracting officer verify the score in SPRS before awarding a contract, task order or delivery order, and again before exercising an option period or extending the period of performance. A score that was fresh at award can lapse in year three of a five-year contract, and the option is where it surfaces.

CMMC keeps a second clock with a different shape. Under DFARS 252.204-7021, a Final Level 2 (Self) status is current when it is not older than 3 years, and the affirmation behind it not older than 1 year: an affirming official, a senior representative of the company, affirms in SPRS after every assessment and annually after a Final status. A shop whose contracts carry both texts keeps both clocks; the CMMC deadline guide works out each one from your dates.

Subcontractors: the prime checks your score

Most small shops meet 7020 from below, in a prime's purchase order. Paragraph (g) is why a prime's buyer may ask for your SPRS score before the PO goes out. It does three things: the substance of the clause goes into every subcontract, commercial ones included and only commercially available off-the-shelf items left out; the prime may not award to a sub without a recent Basic Assessment; and you may post your own Basic Assessment to get one.

Two details in that sentence help a sub. The test covers the systems relevant to the offer; in our reading, a shop that keeps the prime's CUI in one enclave answers for that enclave. And a system run on behalf of the Government is left out. The 7012 side of the same purchase order, which flows down with it, is covered in 7012's flowdown paragraph.

Where the prime's contract carries a CMMC level, 32 CFR 170.23 sets the sub's minimum on top: if a subcontractor will only process, store, or transmit FCI (and not CUI), a CMMC Status of Level 1 (Self) is required; if it will process, store, or transmit CUI, Level 2 (Self) is the minimum requirement. The CMMC level finder reads a PO's clause list for you.

Where CMMC and DFARS 7021 fit

The SPRS score is older than CMMC, and the CMMC rule did not repeal it. DFARS 252.204-7021 adds a second record in the same system: a CMMC status. A Level 2 (Self) assessment and a Basic Assessment look at the same thing, because Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2. What differs is what gets posted and how long it lasts.

The DoD Assessment Methodology's Annex A and 32 CFR 170.24 carry the same point values for every requirement, so one honest count of your 110 requirements serves both records. The differences are in the rules around the count: CMMC caps what may sit on a plan of action and puts a time limit on closing it, which the 7019 and 7020 texts do not. Those rules are in CMMC Level 2 requirements, and the two standards are set side by side in CMMC vs NIST SP 800-171.

Which record a contract asks for depends on its clause list. Until 2028-11-09 a contract carries the CMMC clause only where the program office requires a specific level; from 2028-11-10 it applies to any contract whose systems process, store or transmit FCI or CUI. What is suspended in the meantime is in the status box at the top of this page and, in full, in CMMC status today.

What Class Deviation 2026-O0025 Rev 3 does to them

Class Deviation 2026-O0025, Revision 3 tells contracting officers to use its own DFARS part 240 in lieu of the codified text. That part 240 carries 7012 and 7021, but neither of the two texts on this page. In their place stands one clause:

Read side by side, 252.240-7997 is 7020 with the self-assessment taken out. Everything the Government does stays; everything the contractor posted for itself is gone:

Under the deviation, 252.240-7997 (FEB 2026) replaces 7020: the Government's Medium and High assessments use the 32 CFR 170.24 scoring, and the self-assessment route is CMMC Level 1 or 2 (Self) under 7021. Contracts already awarded keep the clause versions they carry. In the deviated text, the only place a contractor enters its own results in SPRS is 7021(e)(2): a current self-assessment for each CMMC UID not covered by a C3PAO or DIBCAC assessment.

Questions shops ask about 7019 and 7020

How we read the sources