DFARS Compliance Tool

DFARS Clause Identifier

Answer 5 questions about your DoD contract and get an instant mapping of which DFARS cybersecurity clauses apply and what you need to do about each one.

📋

5 Questions

Role, clauses, data type, cloud use, and SPRS status — under 3 minutes.

🛡

CMMC Level

Instantly determine if you need CMMC Level 1 (17 controls) or Level 2 (110 controls).

⏱

Enforcement Timeline

Countdown to Phase 2 enforcement based on your specific clause set.

No account required. Results are stored locally in your browser only.

Supply Chain Position

What is your role in the DoD supply chain?

Your position determines which DFARS flow-down clauses apply to you.

Prime contractor with a DoD contract

You hold the direct contract with a DoD agency (Army, Navy, Air Force, DLA, etc.)

Subcontractor to a prime

You hold a subcontract under a prime contractor. Flow-down clauses still apply to you.

Sub-tier supplier (sub to a sub)

Two or more tiers below the prime. You may still receive CUI flow-downs.

Commercial product / service vendor to DoD

Selling COTS products or services — may have reduced DFARS exposure.

Not sure

Contract Clauses

Does your contract include any of these DFARS clauses?

Check your contract's Section I (Contract Clauses) or ask your contracting officer. Select all that apply.

SELECT ALL THAT APPLY

252.204-7012 Safeguarding Covered Defense Information

The primary CDI/CUI clause. Triggers CMMC Level 2 and the 110-control NIST SP 800-171 requirement. The most common and consequential cybersecurity clause in DoD contracts.

252.204-7019 Notice of NIST SP 800-171 Assessment Requirements

Requires you to have a current SPRS score posted (within 3 years) before award. Mandatory companion clause to 7012 in most contracts issued after Nov 2020.

252.204-7020 NIST SP 800-171 DoD Assessment Requirements

Authorizes DoD to conduct Medium or High assessments of your 800-171 implementation. You must cooperate and provide access within 30 days of request.

252.204-7021 Cybersecurity Maturity Model Certification (CMMC) Requirements

The CMMC clause itself, active since November 2025 (Phase 1). Explicitly requires CMMC certification at the level specified in the solicitation.

252.239-7010 Cloud Computing Services

Applies when cloud services are used for DoD data. Requires FedRAMP Moderate equivalency (or higher) for cloud service providers processing DoD data.

I don’t know / I need to check my contract

Data Classification

What type of information do you handle for this contract?

The type of information you process is the primary CMMC level trigger, independent of which clauses are present.

Federal Contract Information (FCI) only

Basic contract performance data, invoices, routine correspondence. Not CUI-marked. Triggers CMMC Level 1 (17 FAR 52.204-21 practices).

Controlled Unclassified Information (CUI)

Technical data, engineering drawings, export-controlled information (ITAR/EAR), specifications, test results marked CUI. Triggers CMMC Level 2 (110 controls).

Both FCI and CUI

Most common for prime contractors and subs doing development or production work. CMMC Level 2 applies.

Classified information

This tool does not cover classified. Classified programs have separate NISPOM/JSIG requirements. Consult your Facility Security Officer (FSO).

Not sure

Cloud Infrastructure

Do you use cloud services for contract work?

Cloud platform choice affects FedRAMP requirements under DFARS 252.239-7010 and DoD Cloud Computing Security Requirements.

Yes — AWS GovCloud or Azure Government

FedRAMP High authorized. Meets DoD IL4/IL5 requirements for most CUI workloads. Strongest compliance posture for cloud.

Yes — Commercial AWS / Azure / GCP

FedRAMP Moderate authorized regions exist but check specific services. CUI stored here requires verification of FedRAMP authorization and DoD IL2+ equivalency.

Yes — Microsoft 365 GCC or GCC High

M365 GCC High is the DoD-recommended platform for CUI. Meets DFARS 252.204-7012 requirements for covered defense information in email/collaboration.

Yes — Microsoft 365 commercial

M365 commercial (non-GCC) does not meet DFARS 252.204-7012 CDI requirements for CUI. Migration to GCC High is typically required.

No — all on-premise

No cloud exposure. FedRAMP requirements of DFARS 252.239-7010 do not apply.

Not sure

SPRS Status

Have you posted an SPRS score?

SPRS (Supplier Performance Risk System) is the DoD portal where you self-attest your NIST SP 800-171 implementation score. Required under DFARS 252.204-7019.

Yes, within the last 3 years

You are compliant with 252.204-7019 posting requirements. Ensure your score reflects your current posture.

Yes, but it is over 3 years old

Expired. DoD assessors treat a lapsed SPRS score as non-compliant with 252.204-7019. Re-assessment and re-posting required.

You may be in violation of DFARS 252.204-7019 if that clause is present. An SPRS score must be posted before you can be awarded contracts with this clause.

What is SPRS?

SPRS is the DoD’s Supplier Performance Risk System at sprs.csd.disa.mil. Contractors must post a self-assessed NIST SP 800-171 score there before DoD contract award.

DFARS Clause Assessment

Not sure which clauses apply?

Upload your contract scope document and we’ll identify your specific obligations in a 30-minute review call — no cost, no commitment.

Review My Contract →

Sources: DFARS clauses referenced at acq.osd.mil/dpap/dars/dfars [UNVERIFIED]. CMMC Phase timeline per 32 CFR Part 170, published Federal Register Dec 2024. SPRS portal: sprs.csd.disa.mil [UNVERIFIED]. This tool provides informational guidance only — consult qualified legal or compliance counsel for contract interpretation.

We recommend this tool to help improve and optimize your compliance posture. Our approach is designed to enhance security outcomes and strengthen your organization against evolving threats.

DFARS Clause Identifier

5 Questions

CMMC Level

Enforcement Timeline

Your DFARS Compliance Profile

DFARS Clause Assessment

Not sure which clauses apply?

After Identifying Your Clauses