§ 204.7503 - Contract clause.

204.7503 Contract clause.

Use the clause at 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification RequirementsLevel Requirement, as follows:

(a) Until September 30, 2025, in solicitations and contracts or task orders or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial itemsproducts and commercial services, except for solicitations and contracts or orders solely for the acquisition of commercially available off-the-shelf (COTS) items, if the requirement document or statement of work requires a contractor to have a specific CMMC level. In order to implement a phased rollout of CMMC, inclusion of a CMMC requirement in a solicitation during this time period must be approved by OUSD(A&S).

(b) On or after October 1, 2025, in all solicitations and contracts or task orders or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial itemsproducts and commercial services, except for solicitations and contracts or orders solely for the acquisition of COTS items.

[85 FR 61519, Sept. 29, 2020, as amended at 88 FR 6581, Jan. 31, 2023]