Contracting officers can no longer treat CMMC as a future requirement. As of May 7, 2026, DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, is the operative clause governing which contractors are even eligible for award, and it does not describe a simple three-tier ladder. It defines four distinct certification statuses, each with its own validity window and its own consequences for staying on a contract.

Background

CMMC 2.0 exists to verify, rather than merely require, that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) to a defined standard before they touch it. The program rule, 32 CFR Part 170, took effect December 16, 2024, but it does not operate alone. It is paired with the acquisition rule at 48 CFR Part 204, which became effective November 10, 2025, and which is what actually inserts CMMC clauses into solicitations and contracts. Together, the two rules set a phased, three-year rollout: DFARS 252.204-7021 does not appear in every applicable contract on day one. It phases in, contract by contract, until program managers and requiring activities are required to apply it to every applicable FCI/CUI contract starting three years and one day after the acquisition rule's effective date — November 2028.

That phased rollout matters because a contractor can be fully CMMC-ready and still not see the clause in a specific solicitation yet — while a competitor bidding on a later-phase requirement may already need it. The clause's own effective date, May 7, 2026, is the date the clause text itself became usable in contracts, distinct from the phase-in schedule that governs when it actually shows up.

Key Details

DFARS 252.204-7021 does not grant a single pass/fail certification. It recognizes four statuses, and the differences between them determine how often a contractor has to go back through an assessment cycle:

Final Level 1 (Self). Valid for one year, with an annual affirmation of continuous compliance required in the Supplier Performance Risk System (SPRS). This is the self-assessed status — no third-party assessor is required.

Final Level 2 (Self or C3PAO). Valid for three years, again with annual affirmation in SPRS in the intervening years. Depending on the information involved, the assessment may be a contractor self-assessment or one performed by a CMMC Third-Party Assessment Organization (C3PAO).

Advertisement

Final Level 3 (DIBCAC-assessed). Also valid for three years with annual affirmation. This is the status assessed directly by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), reserved for the highest-risk information.

Conditional Level 2/3. This is the status that catches contractors off guard. A Conditional status is valid for only 180 days and exists specifically for contractors who have open Plans of Action and Milestones (POA&Ms) against a handful of allowable, lower-weighted controls. To convert a Conditional status to Final, the contractor must close out those POA&M items within the 180-day window. There is no extension mechanism described in the clause — the status simply expires.

The clause requires a contractor to "have and maintain, for the duration of the contract," a current CMMC status at the level required for any information system that processes, stores, or transmits FCI or CUI under that contract. That is a continuing obligation, not a one-time award condition. A status that lapses mid-performance — because a three-year certification expires, an annual affirmation is missed, or a 180-day Conditional window closes without POA&M resolution — puts the contractor out of compliance with an active contract term, not just a bidding prerequisite.

The flow-down requirement extends the same logic to the supply chain. Subcontractors must independently hold the CMMC level appropriate to the FCI or CUI they will handle before award of the subcontract. A prime cannot self-certify on behalf of a sub, and a sub's missing or lapsed status is the sub's own eligibility problem, not something the prime can paper over. That independence is deliberate: the clause does not let a prime's Final Level 3 status cover a sub that only touches Level 1 information, and it does not let a sub inherit a prime's certification level by association. Each party in the chain is assessed against the level appropriate to the specific information it will actually process, store, or transmit.

What It Means for Contractors

The practical stakes sit at the moment of proposal submission. DFARS 252.204-7021 makes a current, adequate CMMC status a condition of eligibility: an offeror without the required level, or with a status that has expired or lapsed, is not eligible for award on a contract that carries the clause. That is true regardless of how strong the rest of the proposal is on price or technical merit. Contracting officers do not have discretion to waive it once the clause is in the solicitation.

Three planning implications follow directly from the four-status structure. First, know which status your systems actually hold and when it expires — a Level 2 or Level 3 Final certification's three-year clock, and the annual affirmation obligation inside that clock, both need calendar tracking, not memory. Missing an annual affirmation in SPRS is a compliance failure even if the underlying assessment is still technically within its three-year window. Second, treat a Conditional status as a 180-day sprint, not a badge of compliance. Contractors that land in Conditional Level 2 or 3 status need a POA&M closure plan with a hard deadline attached, because the clause offers no grace period once the 180 days run out. Third, if you rely on subcontractors to handle FCI or CUI, verify their CMMC status independently before award rather than taking assurances at face value — their eligibility gap becomes a flow-down risk on your prime contract.

Because the acquisition rule's phased rollout runs into 2028, contractors should also expect the clause to appear in solicitations that did not carry it previously. A safe assumption for any contract touching FCI or CUI is that CMMC eligibility requirements are coming, if they are not already there, and that the fastest way to lose a competition is to discover a lapsed or missing status after the fact rather than before submitting a proposal.

Sources