Which Cybersecurity Clauses Are in Your Contract? A Walkthrough of the Free Clause Checker

Cybersecurity obligations in federal and defense contracts rarely appear as a plain list of tasks. They arrive as clause numbers, often incorporated by reference in a long list near the end of the contract or purchase order, and each number points to text on acquisition.gov. Our free Contract Clause Checker covers five clauses that carry the core cybersecurity obligations for many small defense contractors and explains, in plain language, what each one requires.

Step 1. Find the clauses

Search your contract, solicitation, purchase order, or subcontract for these numbers: 52.204-21, 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021. The first is a Federal Acquisition Regulation (FAR) clause. The rest are Defense Federal Acquisition Regulation Supplement (DFARS) clauses. Check the clause list and any flowdown section, and if you are a subcontractor, check the terms your prime attached as well as the purchase order itself.

Step 2. Select what you found

Check the box for each clause that appears. The checker shows a plain-language summary for each one you select, with a link to the full clause on acquisition.gov. The summaries are readings of the clause text. The clause in your contract controls, so read the full text before you act on it.

Step 3. Read what each clause requires

FAR 52.204-21 applies when your systems process, store, or transmit Federal Contract Information (FCI). It requires 15 basic safeguarding requirements and must be flowed down to subcontractors with FCI in their systems. These are the same 15 requirements behind Cybersecurity Maturity Model Certification (CMMC) Level 1, and our CMMC Level 1 Checklist walks through each one.

DFARS 252.204-7012 requires adequate security on covered contractor information systems, which for systems you operate means implementing National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. It also starts an incident reporting clock. The clause defines the term this way: "'Rapidly report' means within 72 hours of discovery of any cyber incident." Reports go to the Department of Defense (DoD) through the Defense Industrial Base Network (DIBNet) portal at dibnet.dod.mil, which requires a DoD-approved medium assurance certificate. The clause also requires you to preserve images of affected systems for at least 90 days after you report, and requires any cloud provider that handles covered defense information for you to meet security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.

DFARS 252.204-7019 is a solicitation provision. To be considered for award, you need a current NIST SP 800-171 DoD assessment, not more than 3 years old unless the solicitation sets a shorter period, with the summary score posted in the Supplier Performance Risk System (SPRS). Our SPRS Score Estimator shows how the scoring method calculates that number.

DFARS 252.204-7020 requires you to give the government access to your facilities, systems, and personnel for a Medium or High assessment, gives you 14 business days after an assessment to provide additional information or rebut findings, and bars you from awarding a covered subcontract unless the subcontractor has completed at least a Basic assessment within the last 3 years.

DFARS 252.204-7021 requires a current CMMC status at the level the contract specifies for each system that handles FCI or Controlled Unclassified Information (CUI). It requires an affirming official to keep an affirmation of continuous compliance current in SPRS, and it requires you to confirm each subcontractor has a current CMMC status at the right level before you award a subcontract that involves FCI or CUI.

Step 4. Save the result and assign owners

Keep a Portable Document Format (PDF) copy with the Print or Save as PDF button and file it with the contract. Then turn each selected clause into tasks with a named owner: who maintains the system security plan, who posts and updates the SPRS score, who holds the DIBNet certificate and reports incidents, and who checks subcontractor status before award.

What to watch for

Clause dates matter. The Contract Clause Checker lists the version it summarizes, such as DFARS 252.204-7021 (Nov 2025). Your contract may cite an older or newer version, and the obligations follow the version in your contract. Flowdown matters too. Several of these clauses must be passed to subcontractors, so a small company can carry the same cybersecurity obligations as its prime. The checker is a reading aid, not legal advice.

Next steps

If you found 252.204-7012, 7019, or 7020, start with the SPRS Score Estimator and the earlier walkthrough on computing and submitting an SPRS score. If you found only 52.204-21, or the contract calls for CMMC Level 1, start with the Level 1 checklist. To map every obligation in a specific contract to your systems, records, and subcontracts, see our contract review page.

Related reading: Your SPRS Score, Explained and The CMMC Controls You Cannot Put on a Plan of Action and Milestones.

Sources

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems - Acquisition.gov
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting - Acquisition.gov
• DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements - Acquisition.gov
• DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements - Acquisition.gov