A contractor holding a Department of Defense contract can no longer treat CMMC as a future problem to solve before some distant deadline — under DFARS 252.204-7021, the clause already governs any contract where a contracting officer has inserted it, and it sets hard expiration dates on the assessment a contractor is relying on to stay eligible. Miss the aging window on a self-assessment or a C3PAO certification, and the contractor's CMMC status lapses mid-performance, regardless of how the work is going. The clause names four possible statuses, ties each to a specific aging clock, and pushes verification obligations onto primes long before a subcontractor ever touches a proposal.
Which of the Four CMMC Statuses Applies to Your Contract?
DFARS 252.204-7021 does not let a contractor choose its own compliance path. The contracting officer selects one of four statuses and writes it into the solicitation: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), or CMMC Level 3 (DIBCAC). Level 1 covers Federal Contract Information and is always a self-assessment. Level 2 covers Controlled Unclassified Information and splits into two tracks — some contracts accept a contractor's own self-assessment, while others require third-party certification from a CMMC Third-Party Assessment Organization. Level 3 is reserved for the most sensitive CUI and requires assessment by the Defense Industrial Base Cybersecurity Assessment Center, a DoD-run evaluation rather than a commercial one.
The practical effect is that two contractors doing similar work for different program offices can face entirely different CMMC obligations. A contractor bidding on a Level 2 (C3PAO) requirement cannot substitute a self-assessment, no matter how confident it is in its own controls — the contract will specify which of the four boxes applies, and only that box satisfies the clause.
How Long a CMMC Assessment Stays "Current"
Passing an assessment once is not a permanent credential. The clause builds in expiration dates that scale with the level. A Level 1 final self-assessment is valid for one year. Level 2 and Level 3 final assessments run three years, but only if the contractor also completes an annual affirmation in between — a certification, submitted by a company-designated "affirming official," that nothing has changed since the last assessment. The same annual-affirmation duty applies at Level 1 too, folded into its existing one-year cycle. Skip the affirmation and the three-year clock on a Level 2 or Level 3 status effectively stops protecting the contractor, since the requirement is annual, not just at the three-year mark.
Conditional statuses run on a much shorter fuse. A contractor that passed an assessment with open items tracked in a Plan of Action and Milestones (POA&M) holds a Conditional status, and the clause treats that status as current only when it is not older than 180 days, with no compliance change since the Conditional status date and a matching affirmation from the affirming official. A contractor sitting on an open POA&M past that six-month window no longer has a Conditional status the government will recognize — the deficiencies have to be closed out and reassessed, not just documented and left open indefinitely.
Contractors also have to keep the paperwork trail current outside the assessment itself. The clause requires submitting a CMMC Unique Identifier to the contracting officer for each covered contract, keeping the underlying self-assessment score current in the Supplier Performance Risk System (SPRS), and completing the annual affirmation on schedule. A contractor whose SPRS score is stale — reflecting a security posture the company no longer actually has — is out of compliance even if the original assessment technically has not expired.
The Subcontractor Flow-Down Trap
The obligation to verify CMMC status does not stop at the prime's own systems. Under the clause, prime contractors have to flow CMMC requirements down to any subcontractor that will handle FCI or CUI, and they have to confirm that subcontractor's status before award — not after work has started, and not by taking the subcontractor's word for it after the fact. A prime that awards a subcontract to a company without checking its current CMMC status in SPRS is exposed on that subcontractor's compliance gap even though the prime did not create it.
This is where the aging rules compound the risk. A subcontractor's Level 2 self-assessment might have been valid when the prime last checked six months ago, but a missed annual affirmation or an unresolved POA&M past the 180-day Conditional window can quietly invalidate it in the interim. Primes managing a supply chain of any size need a recurring verification step, not a one-time check at proposal submission, because the clock keeps running on every subcontractor independently.
The 2028 Transition Window
Not every contract touching FCI or CUI carries a CMMC requirement today, and that is by design. DFARS Subpart 204.75 sets a phased applicability period: until November 9, 2028, contracting officers apply the clause only if "the program office or requiring activity determines that the contractor is required to have a specific CMMC level." That means a contract can legitimately involve CUI without a CMMC clause attached, if the requiring activity has not yet made that determination for that acquisition.
That window closes on November 10, 2028, but the program office determination does not go away — its trigger just broadens. From that date, the clause attaches whenever the contractor's systems will process, store, or transmit FCI or CUI in performance of the contract, rather than only when the program office separately concludes a specific CMMC level is warranted — closing the gap that lets some CUI-touching work skip the clause today. Contractors not yet seeing CMMC clauses on relevant contracts should treat the current period as a runway, not a signal that certification can wait indefinitely.
What It Means for Contractors
The clause rewards contractors who track their own assessment aging the way they track any other contract deliverable deadline. A Level 1 self-assessment needs renewal annually; Level 2 and Level 3 need the three-year reassessment plus an annual affirmation in between; a Conditional status on an open POA&M has 180 days to close out or expire. Contractors bidding on new work should confirm which of the four statuses the specific solicitation requires rather than assuming their existing certification level automatically qualifies, and primes should build subcontractor CMMC verification into pre-award due diligence as a standing checklist item, not a one-time proposal task. With the clause's trigger broadening to cover essentially any FCI- or CUI-touching contract by November 2028, contractors still operating without a current assessment have a defined amount of runway left, not an open-ended grace period.
