The contract clauses.

01Provisions and clauses: two different jobs

Federal contracting splits its boilerplate into two kinds of instrument, and the split explains most of how the CMMC set fits together. A provision lives in a solicitation: it speaks to offerors, before award, about what they must be or provide to be eligible. A clause lives in the contract: it binds the contractor during performance. The pair DoD built for CMMC works exactly this way — a provision (252.204-7025) tells bidders what level the award requires and gates eligibility on it, and a clause (252.204-7021) obligates the winner to keep that status current all the way through performance, including flowing it down to subcontractors.

Around that pair sits an older trio — 252.204-7012, -7019, and -7020 — that predates CMMC and carried DoD’s cybersecurity expectations while CMMC was being built. Understanding what each one did makes the 2026 cleanup (section 04) make sense instead of looking like churn.

02The map

03How they relate

Three relationships carry the whole picture.

7012 is the substantive duty; CMMC is its verification. The obligation to implement NIST SP 800-171 for covered defense information has been a contract term since well before CMMC — it lives in 7012, alongside the 72-hour reporting clock. CMMC did not replace that duty; it built a structured way to confirm the duty is actually being met. The two travel together in a contract, doing different work.

7019 and 7020 were the visibility pair; CMMC statuses now do that job. Before CMMC statuses existed, DoD’s window into contractor implementation was a self-reported assessment score in SPRS (7019) plus the right to conduct and rely on its own assessments (7020). As CMMC phases in, statuses and affirmations supersede the self-reported score — which is why the 2026 cleanup retired 7019 outright and re-homed 7020’s government-assessment machinery under a new number rather than keeping both systems running in parallel.

7025 and 7021 are notice and obligation, joined at SPRS. The provision names the level and checks the record before award; the clause keeps the record current after it. Both point at the same source of truth — SPRS — which is why a lapsed affirmation has contractual consequences in both directions: it makes an offeror ineligible under 7025, and it breaks the maintenance obligation under 7021.

04The 2026 renumbering

In late 2025 and early 2026, the government began restructuring the FAR and DFARS under the broader FAR Overhaul. DoD issued interim class deviations — effective for solicitations from February 2026 — that moved its cybersecurity coverage out of DFARS subparts 204.73 and 204.75 into 240.370 and 240.371, and renumbered or retired several of the instruments above. The substance of the obligations did not change.

Three caveats keep this honest. The deviations are interim — formal rulemaking to make them permanent takes years, and could adjust them. The codified DFARS text still shows the legacy numbers, because class deviations are published as memoranda, not regulation edits — the authoritative postings live on DoD’s Defense Pricing, Contracting, and Acquisition Policy (DPCAP) class-deviations page. And existing contracts keep the clauses they were signed with, so a working contract file will show a mix of old and new numbers for years. Read the instrument, not just the number.

05A decision path for the stack in front of you

Reading order matters less than knowing what question each document answers. For a specific solicitation or contract:

1. Start with the solicitation’s provisions. Is 252.204-7025 there? Then the required CMMC level is written in it — no inferring needed — and your SPRS status and affirmation must be current at that level to be eligible at all.
2. Then the contract’s clauses. 252.204-7021 means the status must stay current through performance and flow down to your subcontractors. 7012 (or covered-defense-information language) means CUI handling and the 72-hour DIBNet reporting duty are part of the work.
3. No CMMC instruments at all, but FAR 52.204-21 or 52.240-93 present? You are in basic-safeguarding territory: FCI, the 15 requirements, and — as phase-in proceeds — a likely Level 1 (Self) requirement on re-compete (Level 1, in practice).
4. Legacy 7019 or 7020 in an existing contract? They still mean what they say for that contract. Expect their successors (nothing, and 252.240-7997) on the next award.
5. Subcontractor reading a flow-down? Your obligations come from the contract directly above you — the level that flows down tracks what you touch, not automatically what the prime holds. DFARS 252.204-7021; -7020
6. Exclusively COTS? That contract sits outside the CMMC requirement (Glossary) — the exemption covers the contract, not the company.

When a clause and this page seem to disagree, the clause wins: it is the binding text, and this desk is a reading aid. Genuinely unclear cases are contracting-officer questions, not guesses.

06Sources