DFARS and FAR cybersecurity clauses, as of 2026

Four clauses carry the Department of War's cybersecurity requirements into contracts in 2026. FAR 52.204-21 (52.240-93 under the FAR overhaul deviations) sets 15 basic safeguards for federal contract information. DFARS 252.204-7012 requires NIST SP 800-171 for covered defense information and cyber incident reporting within 72 hours. DFARS 252.240-7997 replaced 252.204-7020 for DoD assessments of NIST SP 800-171, and DFARS 252.204-7021 carries the CMMC level. DFARS 252.204-7019 was removed.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

Why the clause numbers changed in 2026

The Department of War is rewriting its FAR supplement under the "Revolutionary FAR Overhaul" through class deviations, listed on the DPCAP class deviation page. Two matter here:

• Class Deviation 2026-O0043, DFARS Part 204, signed February 3, 2026 and effective February 17, 2026. In the deviated Part 204, Subpart 204.73 (Safeguarding Covered Defense Information) and Subpart 204.75 (CMMC) are both "RESERVED"; the line-out shows the old prescriptions for 252.204-7012, 7019, 7020 and 7021 struck.
• Class Deviation 2026-O0025, DFARS Part 240, effective February 1, 2026 and now at Revision 3, dated September 3, 2026. The cyber clauses moved here: 240.370-5 prescribes 252.204-7008, 7009 and 7012 and the new 252.240-7997; 240.371-5 prescribes 252.204-7021 and the provision at 252.204-7025.

Each deviation "remains in effect until rescinded or incorporated into the FAR, DFARS, and DFARS PGI". So the codified text on acquisition.gov and ecfr.gov still shows 252.204-7019 and 7020 (both NOV 2023) while DoD contracting officers use the deviated text. Read the clause as written in your contract.

What does DFARS 252.204-7012 require?

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, goes in every solicitation and contract except those solely for commercially available off-the-shelf (COTS) items. The codified clause is dated MAY 2024; the Part 240 deviation carries a JUN 2026 (DEVIATION 2026-O0025) version. It requires:

• Adequate security. Under (b)(2)(i), a covered contractor information system "shall be subject to the security requirements in" NIST SP 800-171. The deviation text names "Revision 2"; the codified MAY 2024 text names no revision, only the version "in effect at the time the solicitation is issued". NIST withdrew Revision 2 on May 14, 2024 when it published Revision 3; DoD contracts still point at Revision 2.
• Cloud. Under (b)(2)(ii)(D), a contractor using an external cloud service provider for covered defense information "shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline".
• 72-hour incident reporting. Paragraph (a) defines "Rapidly report" as "within 72 hours of discovery of any cyber incident", and (c)(1)(ii) requires the contractor to "Rapidly report cyber incidents to DoD at https://dibnet.dod.mil".
• Medium assurance certificate. Under (c)(3), "the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents".
• Preserve evidence. Under (e), after discovering an incident the contractor shall preserve images of affected systems and monitoring data "for at least 90 days from the submission of the cyber incident report".
• Flowdown. Paragraph (m)(1): "Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information ... without alteration, except to identify the parties."

What happened to DFARS 7019 and 7020?

Before 2026, the provision at 252.204-7019 told offerors they needed a current (not more than three years old) NIST SP 800-171 DoD Assessment to be considered for award, and the clause at 252.204-7020 required access for Medium and High assessments and, in (g)(2), said the contractor "shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800-171 security requirements ... unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment".

Under the deviations:

• 252.204-7019 is removed. The Part 204 deviation strikes it, and we found no replacement provision in the Part 240 deviation text.
• 252.204-7020 became 252.240-7997, "NIST SP 800-171 DoD Assessment Requirements", dated FEB 2026 (DEVIATION 2026-O0025). It is prescribed at 240.370-5(d) for solicitations, contracts and orders other than those solely for COTS items.

What does DFARS 252.240-7997 require?

The clause applies to covered contractor information systems required to comply with NIST SP 800-171 under 252.204-7012. Its content, from the deviation attachment:

• (c) Access. "The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, using the methodology described at 32 CFR 170.24, if necessary."
• (d) Posting. "Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS)."
• (f) Accessibility. Scores "are available to DoD personnel"; contractor representatives "may access SPRS to view their own summary level scores".
• (g) Subcontracts. "The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments", including commercial ones, excluding COTS.

Two things from 7020 are not in 7997. It defines only Medium and High Assessments; the "Basic Assessment" definition is gone, and the deviation gives no reason. The contractor self-assessment is described in 32 CFR part 170 as the CMMC Level 2 (Self) assessment, scored under 32 CFR 170.24. And the 7020(g)(2) sentence barring a subcontract award until the subcontractor had a Basic Assessment is not carried over: 7997(g) is a flowdown sentence only.

DFARS 7012 vs 7021: what is the difference?

DFARS 252.204-7021, dated NOV 2025, requires the contractor under (d)(1)(i) to "Have and maintain for the duration of the contract a current CMMC status" at the level the contracting officer inserts; under (d)(1)(ii) to "flow down the correct CMMC level" per 32 CFR 170.23; under (d)(3) to keep current an annual affirmation in SPRS for each CMMC UID; and under (d)(4) to "Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation". Under (f)(2), before awarding a subcontract the contractor must "ensure that the subcontractor has a current CMMC certificate or current CMMC status" at the level appropriate for the information flowed down.

Since July 13, 2026 the Department of War has suspended CMMC Phase II, so only Level 1 (Self) and Level 2 (Self) may be named in new requirements; see CMMC Phase II is suspended: what still applies.

FAR 52.204-21: the 15 requirements

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Nov 2021), applies when a contractor's system holds federal contract information. Paragraph (b)(1) lists 15 safeguards:

1. Limit system access to authorized users, processes and devices.
2. Limit access to the transactions and functions authorized users may execute.
3. Verify and control connections to external systems.
4. Control information posted on publicly accessible systems.
5. Identify users, processes and devices.
6. Authenticate them before allowing access.
7. Sanitize or destroy media holding federal contract information before disposal or reuse.
8. Limit physical access to systems and equipment to authorized individuals.
9. Escort visitors, keep physical access logs, and control physical access devices.
10. Monitor, control and protect communications at external and key internal boundaries.
11. Put publicly accessible components on separated subnetworks.
12. Identify, report and correct system flaws in a timely manner.
13. Protect against malicious code.
14. Update malicious code protection when new releases are available.
15. Scan systems periodically and scan files from external sources in real time.

Paragraph (c) flows the substance of the clause down to subcontractors (other than COTS) that may hold federal contract information.

Under the FAR overhaul, FAR 40.303-2 prescribes the clause at 52.240-93, Basic Safeguarding of Covered Contractor Information Systems, and the overhauled Part 52 text carries 52.240-93 with the same 15 requirements and the same subcontract paragraph. Class Deviation 2026-O0025 directed DoD contracting officers to use the revised FAR Part 40 from February 1, 2026. Both numbers are in current official text: 32 CFR 170.15 and the attachment to the Department of War's July 13, 2026 memo implementing the CMMC suspension still cite 52.204-21, so read "FAR 52.204-21 (52.240-93 under the FAR overhaul deviations)".

What a prime can ask a supplier for is in How primes check their suppliers' cybersecurity.

Where Tiermark fits

Tiermark's attestation campaigns ask each supplier on a prime's map for a signed DFARS 252.204-7012 baseline attestation: covered defense information handled, NIST SP 800-171 self-assessment and SPRS posting, system security plan, 72-hour DIBNet reporting and medium assurance certificate, FedRAMP Moderate cloud, and 7012 flowdown. Answers come back signed and immutable, and the prime's risk register can derive items from them.

Sources

• DPCAP, DFARS Revolutionary FAR Overhaul class deviations (2026-O0043 Part 204; 2026-O0025 Rev. 3 Part 240)
• DFARS 252.204-7012, 252.204-7021 and 252.204-7020 (codified, NOV 2023)
• FAR 52.204-21; FAR overhaul Part 40 and Part 52
• 32 CFR 170.15, 170.23, 170.24
• NIST SP 800-171 Rev. 2, Rev. 3