Defense Contractors

What arrives

CMMC, or 7021
32 CFR Part 170 and DFARS 252.204-7021. Phase 1 began November 10, 2025, the effective date of the 48 CFR rule; Phase 2 begins one calendar year later.
Source
7012
DFARS 252.204-7012. Safeguarding covered defense information on contractor systems, and reporting a cyber incident to DoD within 72 hours of discovery.
Source
The SPRS score
DFARS 252.204-7019 and 7020. A NIST SP 800-171 DoD Assessment, not more than three years old, with its score posted in the Supplier Performance Risk System.
Source
NIST SP 800-171
CMMC Level 2 incorporates NIST SP 800-171 Revision 2 by reference (32 CFR 170.2). NIST withdrew Revision 2 on May 14, 2024, superseded by Revision 3.
Source
Basic safeguarding
FAR 52.204-21. Basic safeguarding requirements and procedures for contractor information systems that process, store or transmit Federal contract information.
Source
A milling cutter above a round metal blank in a machine shop, coolant mist behind.

Request an Introduction