DFARS 252.204-7021: The CMMC Contract Clause
The CMMC clause itself — making certification a condition of contract award. Went into effect in June 2025. If this clause is in your solicitation, you must be CMMC-certified to win the work.
DFARS 252.204-7021 is the CMMC contract clause — the mechanism by which a specific CMMC level becomes a condition of contract award. When this clause appears in a solicitation, it specifies the required CMMC level (1, 2, or 3) that the awardee and relevant subcontractors must hold at time of award.
What 7021 actually says
- ✓The contractor shall have, and maintain during contract performance, a CMMC certificate at the level specified in the contract
- ✓The contractor shall not award a subcontract if the subcontractor is required to handle CUI, unless the subcontractor has the appropriate CMMC level
- ✓Annual affirmations are required — a senior official must affirm that the certification remains accurate
- ✓Conditional certifications (with an active POA&M) are valid for award purposes under specific conditions
Timeline: when 7021 started appearing in contracts
Phase 1 (December 2024) allowed 7021 to appear in contracts with Level 1 and conditional Level 2 self-assessment requirements. Phase 2 (June 11, 2025) expanded this to require C3PAO-assessed Level 2 certifications in new contracts for prioritized acquisitions.
False Claims Act exposure
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in DFARS & Legal