Contract Clause Checker
What Your Cybersecurity Clauses Require
Select the cybersecurity clauses in your contract or solicitation and see, in plain language, what each one requires of your company.
How to Use the Checker
Defense and federal contracts carry their cybersecurity obligations in Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) clauses. Several of them point to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and to Department of Defense (DoD) assessments. Search your contract, purchase order, or subcontract for the clause numbers below, check the ones you find, and the obligations for each appear underneath.
The summaries are plain-language readings of the clause text on acquisition.gov. The clause in your contract controls, so read the full text before you act on it.
Select one or more clauses above to see what they require.
FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems (Nov 2021)
- Applies when your information systems process, store, or transmit Federal Contract Information (FCI): information provided by or generated for the government under a contract that is not intended for public release.
- Requires 15 basic safeguarding requirements, such as limiting system access to authorized users, authenticating users, sanitizing media before disposal, limiting physical access, protecting communications at your boundaries, correcting flaws in a timely manner, and running malicious code protection and scans.
- Must be flowed down to subcontractors that may have FCI residing in or transiting through their information systems.
- These same 15 requirements are the basis for a Cybersecurity Maturity Model Certification (CMMC) Level 1 self-assessment. Our CMMC Level 1 Checklist walks through each one.
DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024)
- Requires adequate security on every covered contractor information system. For systems you operate, that means implementing National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.
- Requires you to report cyber incidents to the Department of Defense (DoD) within 72 hours of discovery through the Defense Industrial Base Network (DIBNet) portal at dibnet.dod.mil, which requires a DoD-approved medium assurance certificate.
- Requires you to preserve images of affected systems and relevant monitoring data for at least 90 days after you submit an incident report, and to submit any malicious software you isolate to the DoD Cyber Crime Center.
- Requires any external cloud service provider that stores, processes, or transmits covered defense information for you to meet security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.
- Must be flowed down, without alteration except to identify the parties, to subcontractors whose work involves covered defense information or operationally critical support.
DFARS 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements (Nov 2023)
- A solicitation provision. To be considered for award, you must have a current NIST SP 800-171 DoD assessment, not more than three years old unless the solicitation sets a shorter period, for each covered contractor information system relevant to the offer.
- Summary-level scores are posted in the Supplier Performance Risk System (SPRS), along with the assessment date, the systems and Commercial and Government Entity (CAGE) codes covered, and the date you expect to reach full implementation.
- Our SPRS Score Estimator shows how the DoD scoring method calculates a summary score.
DFARS 252.204-7020: NIST SP 800-171 DoD Assessment Requirements (Nov 2023)
- Requires you to give the government access to your facilities, systems, and personnel when it conducts a Medium or High assessment.
- After an assessment, you have 14 business days to provide additional information or rebut findings.
- You may not award a subcontract that is covered by NIST SP 800-171 requirements unless the subcontractor has completed at least a Basic assessment within the last three years, and the clause must be flowed down.
DFARS 252.204-7021: Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025)
- Requires you to have, and keep, a current CMMC status at the level the contract specifies (Level 1 self-assessment, Level 2 self-assessment, Level 2 certification by a third-party assessor, or Level 3) for each system that handles FCI or Controlled Unclassified Information (CUI) under the contract.
- Allows FCI and CUI to be processed, stored, or transmitted only on systems that meet that CMMC level or higher.
- Requires an affirming official to complete and maintain an affirmation of continuous compliance in SPRS, at least annually.
- Requires you to give the contracting officer the CMMC unique identifiers for your systems and report changes during performance.
- Must be flowed down to subcontracts that involve FCI or CUI, and you must confirm each subcontractor has a current CMMC status at the right level before you award the subcontract.
Want a Detailed Follow-Up?
Your results above are yours to keep with no sign-up. If you would like Thabiti to review them and send recommended next steps, add your contact details. Your results are included automatically.
Request received.
Thabiti will review your results and reply within one business day.
Sources
- FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems (Nov 2021) (acquisition.gov)
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024) (acquisition.gov)
- DFARS 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements (Nov 2023) (acquisition.gov)
- DFARS 252.204-7020: NIST SP 800-171 DoD Assessment Requirements (Nov 2023) (acquisition.gov)
- DFARS 252.204-7021: Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025) (acquisition.gov)
Want a Second Set of Eyes?
Bring us the contract. Our Contract Review service maps every cybersecurity clause to the systems, documents, and flow-downs your company needs, before you sign or before a prime asks.