If you have been seeing a new provision called DFARS 252.204-7025 in DoD solicitations and are not sure what it means for your business, you are not alone. This provision became effective November 10, 2025, and it now determines your eligibility to win DoD contracts before you even submit a bid. Here is everything defense contractors need to know.
What Is DFARS 252.204-7025?
DFARS 252.204-7025 is a solicitation provision — not a contract clause — formally titled “Notice of Cybersecurity Maturity Model Certification Level Requirements.” It was created as part of the final CMMC rule under DFARS Case 2019-D041 and became effective on November 10, 2025.
Its purpose is straightforward: to notify potential offerors of the specific CMMC level required before a DoD contract can be awarded. If you see DFARS 252.204-7025 in a solicitation, it means the contracting officer has filled in one of four CMMC levels that you must meet to be eligible for award.
Think of it as the gatekeeper. Miss the requirement, and you cannot win the contract — regardless of how competitive your technical proposal or pricing might be.
What Are the Four CMMC Levels in DFARS 252.204-7025?
The official text of DFARS 252.204-7025 requires the contracting officer to insert one of four options:
- CMMC Level 1 (Self) — applies to contracts involving only Federal Contract Information (FCI). Contractors self-assess against the 15 FAR 52.204-21 practices and submit their results to SPRS annually. No third-party assessor required.
- CMMC Level 2 (Self) — applies to certain limited contracts involving Controlled Unclassified Information (CUI) where the DoD program office has determined that a self-assessment against the 110 NIST SP 800-171 controls is sufficient.
- CMMC Level 2 (C3PAO) — applies to most contracts involving CUI where a formal third-party assessment by a CMMC Third-Party Assessment Organization (C3PAO) is mandatory. This is the most common Level 2 pathway for contracts involving sensitive CUI.
- CMMC Level 3 (DIBCAC) — applies to contracts involving the most sensitive CUI, requiring assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). This is the highest tier and applies to a smaller subset of critical defense programs.
The provision language explicitly states: “This CMMC level, or higher… is required prior to award.” That means you must meet or exceed the specified level to be eligible.
How Is DFARS 252.204-7025 Different from 252.204-7021?
This is one of the most common points of confusion — and it matters.
DFARS 252.204-7025 is a pre-award solicitation provision. It appears in the solicitation documents before you are awarded a contract. Its job is to tell you what CMMC level you need to be eligible to bid and win.
DFARS 252.204-7021 is a contract clause. It appears in the actual contract after award and governs your ongoing CMMC compliance obligations during contract performance. It requires you to maintain your CMMC certification at the specified level throughout the life of the contract.
The relationship is sequential: 7025 sets the requirement before award, 7021 enforces it after award. Both are now active as of November 10, 2025.
A third provision worth knowing: DFARS 252.204-7012 covers cybersecurity incident reporting — it requires contractors to notify the DoD of information security incidents within 72 hours. This provision predates CMMC and remains unchanged under the new rules.
When Does DFARS 252.204-7025 Show Up?
DFARS 252.204-7025 is required in any DoD solicitation that also includes DFARS 252.204-7021 — meaning any solicitation for contracts that involve the processing, storage, or transmission of FCI or CUI.
There is one exception: solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items are exempt.
Importantly, the provision also applies to task orders and delivery orders issued under existing indefinite-delivery indefinite-quantity (IDIQ) contracts — if those orders are issued after November 10, 2025, they may include CMMC requirements even if the base contract predates the rule.
What Does DFARS 252.204-7025 Actually Require You to Do?
To be eligible for award under a solicitation containing DFARS 252.204-7025, you must have two things documented in SPRS before submitting your offer:
- A current CMMC status in SPRS at the required level — for Level 1 this means a completed annual self-assessment submitted through PIEE. For Level 2 C3PAO, this means a current assessment result from an authorized C3PAO.
- A current affirmation of continuous compliance in SPRS — an Affirming Official at your organization must have certified the accuracy of your assessment in SPRS.
If either of these is missing or expired, DFARS 252.204-7025(b)(2) explicitly states you are not eligible for award.
What About Subcontractors?
CMMC requirements flow down. If you are a prime contractor, you are responsible for ensuring that any subcontractors or suppliers that will process, store, or transmit FCI or CUI on their own information systems also meet the required CMMC level.
This means before you bring a subcontractor onto a CMMC-covered contract, you should verify their SPRS status. An unqualified subcontractor handling FCI or CUI can put your prime contract at risk.
What Happens If You Are Not Compliant When You See DFARS 252.204-7025?
If you encounter DFARS 252.204-7025 in a solicitation and your SPRS status is empty, expired, or below the required level, you have a few options:
- For Level 1: Complete your self-assessment, build your documentation (SSP, POA&M, and policies), and submit to SPRS through PIEE. For most organizations this can be accomplished in days to weeks with the right documentation in place.
- For Level 2 Self: Complete your assessment against all 110 NIST SP 800-171 controls, score at 88 or above, and submit through PIEE. This requires significantly more preparation time.
- For Level 2 C3PAO: Engage an authorized C3PAO for a formal assessment. Depending on your current posture, preparation typically takes 3–12 months. Start immediately if you have upcoming bid deadlines.
The key point: don’t wait until you see a solicitation to start preparing. By the time DFARS 252.204-7025 appears in a solicitation you want to win, you need your SPRS status already current.
The False Claims Act Risk
Certifying CMMC compliance you do not actually have — whether by submitting an inaccurate SPRS score or falsely affirming your status — carries significant legal exposure under the False Claims Act. The DoJ has already signaled aggressive enforcement of cybersecurity certification requirements across the Defense Industrial Base.
The safest approach: make sure your SPRS status accurately reflects your actual posture, supported by documentation that can withstand scrutiny. A lower score with a documented POA&M is far safer than an inflated score with nothing behind it.
Free Resource
Not sure if your CMMC Level 1 status is current?
Download the free CMMC Level 1 Readiness Checklist and see exactly where your gaps are before the next solicitation hits your inbox.
Quick Reference: The DFARS CMMC Clause Landscape
| Clause | Type | When It Applies | What It Requires |
|---|---|---|---|
| 252.204-7025 | Solicitation provision | Pre-award, in solicitations | Current CMMC status in SPRS at specified level to be eligible to bid |
| 252.204-7021 | Contract clause | Post-award, in contracts | Maintain CMMC certification throughout contract performance |
| 252.204-7012 | Contract clause | In contracts with CUI | Report cyber incidents within 72 hours |
| FAR 52.204-21 | Contract clause | In contracts with FCI | Implement 15 basic safeguarding requirements (Level 1 basis) |
The Bottom Line for Defense Contractors
DFARS 252.204-7025 is not a bureaucratic formality. It is the mechanism by which the DoD enforces CMMC as a condition of contract eligibility — and it is now active in solicitations across the Defense Industrial Base.
If you have not yet established your CMMC status in SPRS, the time to act is now — not when you see the next solicitation you want to win. For Level 1, that means completing your self-assessment, building your documentation, and submitting through PIEE. For Level 2, it means starting the preparation process immediately.
KyberStorm works with defense contractors at both Level 1 and Level 2 to build the compliance posture you need to remain eligible for DoD contracts. Whether you need a documentation kit to get Level 1 done this week, or advisory support to prepare for a C3PAO assessment, we can help.
Free CMMC Resources
Not sure where your organization stands against the Level 1 requirements in DFARS 252.204-7025? Start with our free gap analysis tool — it walks you through all 15 practices in about 15 minutes so you know exactly what you have and what you still need before the next solicitation arrives.
Download the Free CMMC Level 1 Readiness Checklist
All 15 practices, gap analysis worksheet, and documentation checklist. Free, instant download.
Ready to Establish Your CMMC Status?
CMMC Level 1 Documentation Kit — $897
Everything you need to support your Level 1 SPRS submission — System Security Plan, POA&M, Control Tracker, and all required policies — in editable Word format. Built by a CISSP-certified GRC professional. One-time purchase, instant download.
Get the Kit →
CMMC Level 2 Advisory Services
Preparing for a C3PAO assessment or need help with your NIST SP 800-171 documentation? KyberStorm provides gap assessments, SSP development, and full Level 2 compliance program support.
Contact us at info@kyberstorm.com →
Penetration Testing & Red Teaming
Validate your security controls before your assessment with penetration testing built for defense contractors.
Contact us at info@kyberstorm.com →
KyberStorm is a CISSP-certified cybersecurity advisory firm based in the Greater DMV area, specializing in CMMC, FedRAMP, and DoD compliance. Questions? info@kyberstorm.com.