NIST SP 800-171 DoD Assessment Requirements
Effective: November 30, 2020
DFARS 252.204-7020 is the contract clause companion to -7019: once awarded, the contractor must allow DoD access to conduct Medium or High NIST SP 800-171 assessments, have summary level scores posted in SPRS, and insert the substance of the clause in every subcontract except COTS-only purchases. It binds the obligation throughout contract performance, not just at offer.
Who must comply
Any DoD contractor under a contract that includes the clause, and every subcontractor at any tier that receives its substance through the mandatory flow-down.
What it requires
- 01Provide DoD access to facilities, systems, and personnel necessary to conduct a Medium or High NIST SP 800-171 DoD Assessment if requested.
- 02Ensure summary level scores of NIST SP 800-171 DoD Assessments are posted in SPRS; contractors submit Basic Assessment results for posting.
- 03Not award any subcontract that is subject to NIST SP 800-171 (via DFARS 252.204-7012) unless the subcontractor has at least a Basic Assessment, not more than three years old, posted in SPRS.
- 04Insert the substance of the clause in ALL subcontracts and other contractual instruments, including those for commercial products and services, excluding only COTS items. The flow-down is not limited to subcontractors handling CUI; only the pre-award assessment gate is.
Related clauses
- DFARS 252.204-7012Safeguarding Covered Defense Information and Cyber Incident Reporting
DFARS 252.204-7012 requires DoD contractors that handle Covered Defense Information (CDI) to implement the security requirements of NIST SP 800-171, report cyber incidents to DoD within 72 hours via the DIBNet portal, and use FedRAMP Moderate (or equivalent) cloud services for CDI. It has been the contractual basis for NIST 800-171 across the defense industrial base since 2017.
- DFARS 252.204-7019Notice of NIST SP 800-171 DoD Assessment Requirements
DFARS 252.204-7019 requires offerors on DoD solicitations involving CUI to have a current NIST SP 800-171 self-assessment score posted in the Supplier Performance Risk System (SPRS) before they are eligible for award. The score must not be more than three years old at the time of the offer.