DFARS 252.204-7012, 7019, 7020, and 7021 Explained

Clause Roles at a Glance

How They Fit Together

7012 is the longstanding safeguarding and incident-reporting engine. 7019/7020 tightened SPRS and assessment visibility for 800-171. 7021 adds the CMMC status requirement as a contract mechanism. Suspension of Phase II changes which CMMC assessment types requiring activities may designate — it does not delete 7012.

How CyberSilo Helps

• Map technical evidence to 800-171 / CMMC requirements that 7012 and 7021 assume
• SIEM and IR workflows that support the 72-hour reporting capability
• Readiness for SPRS-aligned affirmation cycles

Frequently Asked Questions

Does 7021 replace 7012?

No. 7021 addresses CMMC programme compliance in contracts. 7012 remains the safeguarding and 72-hour cyber incident reporting clause.

What do 7019 and 7020 mainly do?

They notify and require NIST SP 800-171 DoD assessment posture — including SPRS-related expectations and government assessment cooperation.

Did Phase II suspension remove these clauses?

No. Suspension limits which CMMC levels/assessment types requiring activities may designate. 7012 safeguarding and self-assessment obligations continue.

Related CMMC Resources

CMMC hub · 72-hour IR · Flow-down · Level 2 · CSA