How Do DFARS and CMMC Fit Together?

Two rulebooks seem to cover the same ground. Your contract cites DFARS clauses, and everyone talks about CMMC. They are not two copies of the same rule. They are two halves of one system.

What each side does

DFARS is the Defense Federal Acquisition Regulation Supplement. It is the contract rulebook DoD uses in its solicitations. Three DFARS clauses carry the cybersecurity load today.

DFARS 252.204-7012 requires contractors to safeguard covered defense information on their systems. Safeguarding means implementing the security requirements of NIST SP 800-171. NIST is the National Institute of Standards and Technology. The clause also requires reporting cyber incidents to DoD within 72 hours of discovery (DFARS 252.204-7012).

DFARS 252.204-7019 is the pre-award notice. It tells offerors that DoD will check the Supplier Performance Risk System for a current 800-171 assessment before award. SPRS is the Supplier Performance Risk System. No current score in SPRS means no award (DFARS 252.204-7019).

DFARS 252.204-7020 is the contract clause that defines the assessments themselves: Basic self-assessment, Medium assessment, and High assessment. The Basic score is the 110-point self score posted to SPRS. Medium and High are DoD-led assessments by the Defense Industrial Base Cybersecurity Assessment Center (DFARS 252.204-7020).

CMMC is the Cybersecurity Maturity Model Certification. It is the program that verifies contractors actually implemented 800-171. The program rule is 32 CFR Part 170 (32 CFR Part 170). DFARS 252.204-7021 is the acquisition clause that puts CMMC requirements into contracts. Think of it this way: DFARS clauses set the bar, and CMMC checks that you cleared it.

The fit, in one picture

NIST SP 800-171 Revision 2 is the standard both sides share. It holds 110 security requirements for protecting CUI. CUI is Controlled Unclassified Information (NIST SP 800-171 Revision 2).

DFARS 7012 already requires those 110 requirements today, with no verification beyond your own word and the SPRS score. CMMC adds independent verification on top of the same 110 requirements. Level 1 covers 15 basic practices from FAR 52.204-21. Level 2 covers all 110 practices of 800-171. Level 3 adds selected requirements from NIST SP 800-172.

The rules do not change the standard. They change who believes you. A self-attested score satisfies 7020 today. A C3PAO assessment satisfies 7021 for Level 2 as the phases roll out. The 110 requirements underneath stay the same.

What you must do now

Keep meeting DFARS 7012. The incident reporting duty and the safeguarding duty apply whether or not CMMC appears in your contract. CMMC phases do not pause DFARS.

Keep your SPRS score current. The 7019 pre-award check reads SPRS. An expired or missing Basic assessment can lose you a contract before anyone mentions CMMC.

Start closing the gap between your self-attested score and what a C3PAO would find. Score your 110 requirements honestly, one by one, with evidence for each. The DoD assessment methodology deducts 1, 3, or 5 points per unmet requirement from a 110 start. Your SPRS entry is a formal statement to DoD, so score conservatively.

Track the CMMC phases in 32 CFR Part 170. DoD adds CMMC requirements to contracts in phases. When 7021 appears in a solicitation you want, you need the stated CMMC status by award. Check the phase timeline, then work backward to your assessment date.

Next step

PolicyCortex collects evidence from live Azure configuration using 33 collectors. The collectors read conditional access, diagnostic settings, Defender posture, backup, and firewall. The evidence is evaluated against NIST 800-53 and NIST 800-171. It supports re-verification after remediation. It generates SSP, SAR, and POA&M output from collected evidence. SSP means System Security Plan. SAR means Security Assessment Report. POA&M means Plan of Action and Milestones. PolicyCortex is strongest in commercial Azure, and AWS is covered. Start at https://policycortex.com.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, Defense Federal Acquisition Regulation Supplement. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
• DFARS 252.204-7019, Notice of DoD Assessment Requirements, Defense Federal Acquisition Regulation Supplement. https://www.acquisition.gov/dfars/252.204-7019-notice-dod-assessment-requirements
• DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, Defense Federal Acquisition Regulation Supplement. https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171-dod-assessment-requirements
• DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement, Defense Federal Acquisition Regulation Supplement. https://www.acquisition.gov/dfars/252.204-7021
• 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program, U.S. Department of Defense, eCFR. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, National Institute of Standards and Technology, February 2020. https://doi.org/10.6028/NIST.SP.800-171r2