DFARS 204.7504 Solicitation provision and contract clause
Section Defense Federal Acquisition Regulation Supplement
Facts
- Citation
- DFARS 204.7504
- Type
- Section
- Supplements
- FAR Part 4 Administrative and Information Matters
- Last amended
- 90 FR 43560 Effective Nov 10, 2025
- Text as of
- DFARS Change May 7, 2026
- Official text
- acquisition.gov
Text from acquisition.gov. Federal Register history from the Federal Register's records of the rules that amended this section.
Text
(a) Unless the requirements at 32 CFR 170.5(d) are met, use the clause at 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, as follows:
(1) Until November 9, 2028 in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of commercially available off-the-shelf (COTS) items, if the program office or requiring activity determines that the contractor is required to have a specific CMMC level.
(2) On or after November 10, 2028 in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of COTS items, if the program office or requiring activity determines that the contractor is required to use contractor information systems in the performance of the contract, task order, or delivery order to process, store, or transmit FCI or CUI.
(b) Use the provision at 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements, in solicitations that include the clause at 252.204-7021.
Federal Register history
Quick answers
What is DFARS 204.7504?
DFARS 204.7504 is a section of the Defense Federal Acquisition Regulation Supplement, titled "Solicitation provision and contract clause".
When was DFARS 204.7504 last changed?
The most recent final rule on record is "Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)" (90 FR 43560), published Sep 10, 2025 and effective Nov 10, 2025.
Are changes to DFARS 204.7504 proposed?
No proposed rule from the last 3 years is waiting on a final rule.
On GovTribe
Follow the rules behind federal contracts
- Search Federal Register rules and proposed rules for the FAR, DFARS and agency supplements
- Solicitations, awards and government files in one search
- Ask GovTribe AI about the rules that apply to a contract