The government can still check your cybersecurity score

Checked on 8 October 2026.

What happened

The Department of War (the new name of the Department of Defense) has rewritten its contract rules, the DFARS (Defense Federal Acquisition Regulation Supplement). The clause that lets the government check a contractor’s cybersecurity has a new number: DFARS 252.240-7997, dated February 2026, formerly 252.204-7020.

The same official memo that carries the pause of outside CMMC (Cybersecurity Maturity Model Certification) assessments still tells contracting officers to put this clause in requests for bids and contracts. Only purchases solely of off-the-shelf commercial items are left out.

Here is what the clause says.

  • Who it covers. Systems that must meet NIST SP 800-171, a list of security requirements from NIST (the National Institute of Standards and Technology), under DFARS 252.204-7012. In practice, those that handle CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes).
  • Two kinds of check. Government assessors run a Medium assessment (a thorough review of your documents, with questions) or a High assessment (also asking you to show that each requirement works as your written plan describes). That plan is your SSP (System Security Plan): your document describing your systems and how you meet each requirement.
  • You give access. The clause requires you to give the assessors access to your facilities, systems and people.
  • Their result counts most. When DCMA (the Defense Contract Management Agency) does the assessment, its results “take precedence over any other assessment”, your own score included.
  • It reaches subcontractors. The clause must be passed down, so a supplier to a prime contractor gets it too.

What it means for you

The pause of outside assessments does not touch this clause. Your self-assessment score is a statement to the government, and it can be checked.

The CMMC program rule says the same. Under 32 CFR 170.16 and 170.17, DCMA’s DIBCAC team (Defense Industrial Base Cybersecurity Assessment Center) may assess a company with a Level 2 status. If the requirements are not met, the DIBCAC result takes precedence over that status. The company cannot win new contracts needing that level for that system until it has a new status, and the usual contract remedies become available.

In one case settled in June 2026, the Justice Department says a DCMA assessment gave LOGZONE, a Huntsville contractor, a score of -170, near the bottom of the range from -203 to 110. The claims in that case are allegations only; there was no finding of liability.

The rules say these checks should not repeat another Department or CMMC assessment, except in rare cases, such as when cyber threats have changed.

What comes next

If you are assessed, the Department shares your score and gives you a chance to dispute it before posting it in SPRS, the government website where you report your results. The memo stays in force until it is withdrawn or written into the permanent rules.

What to do now

  1. Make sure your SSP describes what is really in place today.
  2. For each requirement, keep proof you could show an assessor: a screenshot of the setting, a one-page list, or an email from your IT provider confirming it.
  3. Compare your score in SPRS with your records. If something has changed, we suggest you fix the gap or update the score.
  4. Decide now who would answer an assessor’s questions. For example, the owner, with your IT provider.
  5. If you are assessed, use the 14 business days the clause gives you to send any proof the assessors did not see.

Sources