DFARS 252.204-7019 and -7020: keeping your NIST SP 800-171 assessment current

Implementing NIST SP 800-171 is not enough to win a DoD contract that involves covered defense information: you also need a current assessment of that implementation on file in the Supplier Performance Risk System (SPRS). Two DFARS rules set that requirement. The solicitation provision DFARS 252.204-7019 applies to offerors, and the contract clause DFARS 252.204-7020 applies during performance and to subcontractors. Both generally accompany DFARS 252.204-7012 in solicitations and contracts, except those solely for commercially available off-the-shelf (COTS) items.

What -7019 requires of offerors#

If you are required to implement NIST SP 800-171 under DFARS 252.204-7012, then to be considered for award you must have a current NIST SP 800-171 DoD Assessment:

• Current means not more than three years old, unless the solicitation specifies a shorter period.
• It must cover each covered contractor information system relevant to your offer (systems that are part of an IT service or system you operate on behalf of the Government are excluded; they fall under other requirements).
• It can be a Basic (self), Medium or High assessment, scored with the DoD Assessment Methodology.
• The summary results must be posted in SPRS, where the contracting officer checks them.

In practice, this turns your assessment date into an eligibility date. A company whose last Basic assessment completed three years and one day before award is not "current," even if nothing about its security has changed.

What -7020 adds during performance#

• Government access. You must give DoD access to your facilities, systems and personnel when it conducts a Medium or High assessment.
• Flowdown. You must include the substance of the clause in your subcontracts and other contractual instruments, including those for commercial products and services, except those solely for COTS items.
• Subcontractor check. You may not award a subcontract that requires NIST SP 800-171 implementation under DFARS 252.204-7012 unless the subcontractor has completed, within the last three years, at least a Basic assessment for its covered systems and posted the results in SPRS.

That third point is why primes ask about your assessment date before they ask about anything else. A missing or stale assessment can stop a subcontract award.

How CMMC fits#

CMMC Level 2 assessments use the same requirements and scoring (32 CFR 170.24), and their results are also recorded in SPRS. CMMC adds its own lifecycle on top: a three-year status period, annual affirmations, and Final or Conditional status (see Final vs. Conditional status). During the CMMC phase-in you may see solicitations with both sets of requirements, so keep both calendars.

Build a renewal calendar#

Checklist before you submit an offer#

Common pitfalls#

• Missing CAGE codes. If your offer uses a CAGE code that is not associated with the posted assessment, the contracting officer may not find a current assessment for you.
• Letting the clock run out mid-pursuit. Long capture cycles mean an assessment that was current at proposal can be stale by award. Check the date against the expected award date, not the proposal date.
• Assuming the prime covers you. Each subcontractor that handles covered defense information needs its own current assessment.
• Over-relying on a one-time score. Your assessment reflects a point in time. If your environment changes, the score you posted may no longer describe it.

How TeamingIndex helps#

• Profiles show each partner's SPRS assessment date and type, and whether the assessment is still current under the three-year rule, without revealing the score (see blind SPRS brackets).
• Keep your own assessment date current on your compliance dashboard so primes see you are eligible.
• In the Team Builder, partners with stale or missing assessments stand out before you commit workshare.
• For how the score is calculated, see NIST SP 800-171 scoring.