New numbers for the cybersecurity clauses in your contracts
Checked on 8 October 2026.
What happened
- 18 December 2025. The Department of War (the new name of the Department of Defense) began rewriting the DFARS (Defense Federal Acquisition Regulation Supplement: its own contract rules), part by part. The FAR (Federal Acquisition Regulation: the contract rules for every federal agency) was being rewritten the same way.
- 1 February 2026. The rewritten parts took effect through official memos called class deviations. A law firm says the Department planned to use the rewritten FAR from that day too.
- The cybersecurity rules moved. They now sit in a new Part 40 of the FAR and Part 240 of the DFARS, both called “Information Security and Supply Chain Security”. Some clauses got new numbers.
Here are the main cybersecurity clauses.
| Old number | New number | What it covers |
|---|---|---|
| FAR 52.204-21 | FAR 52.240-93 | The 15 basic safeguards for FCI (Federal Contract Information: information about your government work that is not public). Same title, same 15 safeguards. |
| DFARS 252.204-7012 | Same number | Protecting CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes, such as drawings) with NIST SP 800-171, a list of security requirements from NIST (the National Institute of Standards and Technology). Also reporting cyber incidents. |
| DFARS 252.204-7021 | Same number | The CMMC (Cybersecurity Maturity Model Certification) level a contract names, and your CMMC status in SPRS, the government website where you report your results. |
| DFARS 252.204-7020 | DFARS 252.240-7997 | Checks of your NIST SP 800-171 work by government assessors. The new clause covers only these, called Medium and High assessments. |
| DFARS 252.204-7019 | None | The notice that asked for a current NIST SP 800-171 assessment score in SPRS before award. The rewritten rules drop this notice, not SPRS reporting: see below. |
What has not changed
- The 15 basic safeguards for FCI are the same list. CMMC Level 1 is built on them.
- If you handle CUI, DFARS 252.204-7012 still requires NIST SP 800-171. The new version of the clause names Revision 2. It still requires you to report a cyber incident within 72 hours.
- Where a contract names a CMMC level, DFARS 252.204-7021 still asks you to enter your self-assessment results in SPRS. A senior person at your company still confirms them every year.
What it means for you
You may see old and new numbers side by side. Contracts and purchase orders written before February 2026 may still show the old ones. So does the CMMC program rule, 32 CFR Part 170: as of 8 October 2026 it still uses the old numbers.
The end of 252.204-7019 does not mean a score is no longer needed. Where a contract names a CMMC level, 252.204-7021 still asks for your CMMC status in SPRS.
What comes next
The memos stay in force until they are withdrawn or written into the permanent rules. The permanent rules go through public comment first.
Numbers may change again. A proposed rule published on 23 June 2026 would replace the FCI clause with FAR 52.240-5, Covered Federal Information. As of 8 October 2026 it is only a proposal.
What to do now
- Keep the table above to hand when you read a new contract, purchase order or request for bids.
- Wherever you list the clauses your company works under, write the new number next to the old one.
- If you are not sure which clauses apply to you, ask the contracting officer named in the contract, or your contact at the company you supply.
- Keep going with the same security work.
Sources
- Class Deviation 2026-O0025, Revision 3, the official memo with the rewritten DFARS Part 240 and its clauses (PDF).
- FAR overhaul Part 40, the rewritten federal rules, on the government’s acquisition website.
- The proposed rule of 23 June 2026, in the Federal Register.
- 32 CFR Part 170, the CMMC program rule.
- A law firm’s summary of the DFARS overhaul (Wiley).
- DFARS 252.204-7019, the old notice, in the official rules.