Where 252.204-7019 checks a score before award, 252.204-7020 is the clause that carries the same NIST SP 800-171 assessment framework through contract performance. It requires the contractor to provide the government access to facilities, systems, and personnel as necessary for DoD to conduct or verify Medium or High Assessments when the government elects to run one.
The clause keeps the same Basic, Medium, and High Assessment structure defined for the program: Basic is a contractor self-assessment, Medium and High are government-led assessments that validate and score the implementation of NIST SP 800-171 more rigorously.
Its subcontractor flowdown duty is the part most often missed by small primes: before awarding a subcontract or other contractual instrument, the contractor has to ensure the subcontractor has a current NIST SP 800-171 assessment (at least Basic) posted in SPRS for any covered contractor information system that will be used to perform the subcontracted work involving covered defense information.
What this contract clause actually requires
- Grant DoD access to facilities, systems, and personnel as needed to conduct or verify a Medium or High Assessment when required.
- Keep the posted SPRS score current for the covered system throughout the period of performance, not only at the moment of award.
- Before subcontract award, verify the subcontractor has a current, qualifying NIST SP 800-171 assessment score posted in SPRS for the system it will use.
- Treat a change in system boundary, provider, or architecture during performance as a trigger to re-check whether the posted score still describes the environment doing the work.
Where small contractors get this wrong
- ✗Treating 7020 as satisfied once by the prime's own SPRS score, without ever checking subcontractor scores before subcontract award.
- ✗Letting a posted score go stale during a multi-year contract without a recurring check against the currency window.
- ✗Assuming 7020 is the safeguarding duty itself — it is the assessment and verification mechanism; the underlying safeguarding requirement sits in 252.204-7012.
- ✗Not updating the record when the system that performs the work changes mid-contract (new tenant, acquired business unit, new MSP).
Common questions
Who has to check subcontractor SPRS scores under 252.204-7020?
The prime contractor (or higher-tier subcontractor making the award) is responsible for verifying that a subcontractor has a current, qualifying NIST SP 800-171 assessment score posted in SPRS before awarding a subcontract involving covered defense information.
Does 252.204-7020 require a new government assessment on every contract?
No. Medium and High Assessments happen when the government elects to conduct or verify one. Most small contractors operate under Basic (self) Assessments unless a specific solicitation or DoD component requires more. See our Medium and High Assessment readiness guide for what the government-led review specifically checks.
Official sources used for this page
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
