252.204-7019 sets a before-award condition: if the offeror is required to implement NIST SP 800-171, it must have a current assessment — Basic, Medium, or High, as defined in the companion clause 252.204-7020 — for every covered contractor information system relevant to the specific offer, contract, task order, or delivery order.
'Current' means not more than three years old unless the solicitation names a shorter window. The provision does not ask the offeror to run a new assessment as part of proposal writing; it asks the offeror to verify that a qualifying summary-level score is already posted in the Supplier Performance Risk System (SPRS).
If no qualifying score exists, the offeror can conduct and submit a Basic (self) Assessment using the NIST SP 800-171 DoD Assessment Methodology, for posting to SPRS, rather than being disqualified outright — but that has to happen before the government relies on the representation, not after.
What this solicitation provision actually requires
- Check SPRS for a summary-level score before the proposal is due, for the exact system that will perform this specific effort.
- Confirm the score's age against the solicitation's own currency window — some solicitations require shorter than the default three years.
- If no current score exists, a Basic Assessment can be self-conducted and submitted for SPRS posting using the published DoD assessment methodology.
- The check is per system, per offer — a current score for one enclave does not cover a different system proposed for a different opportunity.
Where small contractors get this wrong
- ✗Assuming a company-wide 'we did an assessment once' claim satisfies the provision without confirming the SPRS record and its date.
- ✗Checking SPRS only after the contracting officer raises a question, instead of during proposal preparation.
- ✗Scoring the wrong boundary — a system different from the one that will actually process, store, or transmit CUI for this contract.
- ✗Missing a shorter currency window stated in the specific solicitation and relying on the default three-year rule instead.
Common questions
Is 252.204-7019 the same as the assessment clause that applies during performance?
No. 7019 is the pre-award solicitation provision that checks SPRS before award. 252.204-7020 is the contract clause covering the ongoing obligation during performance, including subcontractor flowdown.
Can a company submit a self-assessment to satisfy 7019 if nothing is posted in SPRS?
Yes — a Basic Assessment can be conducted and submitted for SPRS posting under the published NIST SP 800-171 DoD Assessment Methodology, but it needs to happen before the offer is relied on, not after.
Official sources used for this page
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
