DFARS 252.240-7997 is a new Part 240 deviation clause for NIST SP 800-171 DoD Assessments. It gives the Government a contractual path to conduct a Medium or High assessment of a covered contractor information system, including necessary access to facilities, systems, and personnel. It also describes how results are recorded and how a contractor can provide information or rebut findings. The clause matters because it can appear in a solicitation even when a team is focused mainly on CMMC.
The governing text is time-sensitive. The September 3, 2026 Revision 3 of Class Deviation 2026-O0025 places the clause at 252.240-7997 and prescribes it in section 240.370-5(d). The clause’s own applicability paragraph ties it to covered contractor information systems that must comply with NIST SP 800-171 under 252.204-7012. That is different from saying every business, every system, or every contract automatically receives the same assessment. Read the actual solicitation and contract, then map the clause to the system and data in scope.
Start with the right version and the clause’s own scope
For work performed under the Department of War’s deviation, start with the current Revision 3 attachment for DFARS Part 240, dated September 3, 2026. Older summaries may cite the clause as 252.204-7020, quote the earlier 240.370-5 paragraph number, or describe the old codified structure without distinguishing it from the deviation text. Those documents can still explain the familiar assessment concepts, but they are not a substitute for checking the clause actually included in the procurement. Keep a copy of the solicitation version, its clause list, and any amendments with the opportunity record.
Paragraph (b) of 252.240-7997 says the clause applies to covered contractor information systems required to comply with NIST SP 800-171 in accordance with 252.204-7012. Section 240.370-5(d) directs contracting officers to insert it in solicitations, contracts, task orders, and delivery orders, including commercial-product or commercial-service procedures, except those solely for COTS items. Read both parts together: the prescription explains where the clause is inserted, while the clause applicability paragraph connects its assessment duties to the covered system and the safeguarding requirement. Neither sentence is a universal CMMC certification rule.
Understand what Medium and High mean in this clause
The clause defines both assessment levels as Government-conducted reviews using NIST SP 800-171A and trained personnel. A Medium Assessment includes review of prior assessments where relevant, thorough document review, and discussions to obtain clarification. A High Assessment includes those elements and adds verification, examination, and demonstration of the system security plan’s implementation. In practical terms, the difference is not simply the length of a meeting. The High description expressly expects reviewers to test whether the environment and evidence support what the SSP says.
This distinction is useful for preparation. A Medium review needs a coherent document set, clear answers, and a reliable link from each claimed safeguard to the organization’s SSP and evidence. A High review needs the same foundation plus a safe way to demonstrate implementation: a system owner who can show the relevant configuration, records that reflect normal operation, and an access plan that does not expose unrelated systems or credentials. Do not label an internal tabletop as a Government Medium or High Assessment; it is a rehearsal, not the official activity.
Plan access that is necessary and controlled
Paragraph (c) requires the contractor to provide access to facilities, systems, and personnel necessary for a Medium or High assessment, if one is necessary. The word necessary matters. The clause does not itself say that assessors receive unrestricted access to every corporate tenant, production environment, customer record, or employee device. It does require the organization to cooperate with the access needed to assess the covered system. Contracts, security, and IT should identify the boundary first, then arrange a practical, authorized way to inspect the relevant environment.
Prepare a short access plan before a request arrives. Name the contract lead, facility contact, system owner, security lead, identity administrator, and people who can explain key SSP sections. Identify the approved demonstration environment, the process for temporary accounts if required, escort and logging arrangements, and how sensitive screenshots or exports will be handled. Never send passwords in a meeting invite or use a personal account to improvise access. If the requested scope seems broader than the covered system, document the question and resolve it through the contracting and assessment channels instead of silently granting access or refusing the clause.
- Map each covered system and its SSP to the contract and CAGE code records.
- Use named owners and approved, time-limited access arrangements.
- Keep unrelated customer data and credentials out of demonstrations.
Know what the clause says will appear in SPRS
Paragraph (d) addresses summary-level results in the Supplier Performance Risk System. The listed details include the assessed standard, the organization conducting the assessment, associated industry CAGE codes, assessment date and level, the overall numerical score, and the date all requirements are expected to be implemented based on related plans of action. That is a summary record, not a public report of every control or evidence file. Teams should still ensure the system security plan, score, CAGE-code mapping, and expected implementation date are consistent before the review begins.
A score in SPRS does not by itself prove that the right system was assessed or that every proposal is ready. Reconcile the score record to the system boundary, contract flow, and current SSP. If an organization has multiple enclaves or CAGE codes, document which belong to the assessed environment and who confirmed the mapping. If the published summary looks wrong, use the clause’s process and the relevant SPRS instructions; do not assume that a company-wide score automatically covers a separate system or a newly added enclave.
Treat the 14-business-day period as a focused rebuttal window
Paragraph (e) says DoD will provide Medium and High summary scores to the contractor and provide an opportunity for rebuttal and adjudication before posting those scores to SPRS. After completion of each assessment, the contractor has 14 business days to provide additional information showing that requirements not observed by the team were met or to rebut findings in question. This is a short evidence and clarification window. It is not a general extension for installing safeguards after the assessment or a promise that every disagreement will change the result.
Prepare a response table with one row per finding: requirement, exact observation, contractor’s factual position, evidence that existed during the assessment, owner, and reviewer. Separate a genuine implementation gap from an evidence gap, a boundary misunderstanding, or a control that the team could not observe. If evidence was already operating but was not produced, identify its date and provenance. Do not backdate a policy, create a new screenshot and present it as historical proof, or rewrite the SSP after the fact without marking the version and date. Preserve the record that supports both the original assessment and the response.
Keep this clause distinct from CMMC status and 252.204-7020
A Medium or High NIST SP 800-171 DoD Assessment is not the same record as a CMMC status. The Part 240 text states that Medium or High assessments conducted by DCMA take precedence over other assessments in the circumstances it cites, but that does not collapse the two programs into one database field. CMMC has its own status, UID, level, and affirmation framework under 32 CFR Part 170 and the applicable CMMC clause. When a solicitation includes both requirements, track them as separate obligations and connect each to the right systems and evidence.
Contractors may also encounter older references to DFARS 252.204-7020, the long-standing NIST SP 800-171 DoD Assessment clause. Avoid assuming a clause number in a blog post controls the contract. Compare the actual clause text and version in the solicitation with the applicable deviation or codified DFARS, and ask the contracting officer to clarify an inconsistency. For a practical internal register, give each assessment requirement its own row: source clause, covered system, assessment type, date, score location, CAGE codes, expected remediation date, and owner.
Flow the assessment clause to covered subcontracts
Paragraph (g) requires the contractor to insert the substance of 252.240-7997, including paragraph (g), in all subcontracts and other contractual instruments, including those for commercial products or services, excluding commercially available off-the-shelf items. That is a clause-flowdown instruction; it should not be replaced with a generic vendor questionnaire or an assumption that every supplier relationship has identical scope. Start with what work the subcontract performs, which system will handle covered information, and the actual contract language, then make sure the required clause substance travels with the relevant award documents.
A prime’s subcontract file should show the flowdown decision, version of the clause, subcontract system or boundary, supplier contacts for assessment coordination, and how the supplier will respond to a Government request that affects its covered system. Coordinate contract administration and security before the first assessment request. If a supplier believes the clause does not apply to its environment or the COTS exclusion applies, record the basis and escalate any ambiguity; do not simply remove the text from a template without authority.
A preparation sequence small teams can maintain
Begin with scope, not a document sprint. Confirm what information the contract identifies, the system that handles it, the applicable 252.204-7012 and 252.240-7997 language, and the SSP that describes the system. Verify the score and CAGE-code associations in SPRS. Then choose a sample of requirements across different families and trace each one from SSP statement to current artifact, operational owner, and, for a likely High review, a demonstration that can be performed safely.
Run a short internal exercise with someone who did not implement the controls. Ask that reviewer to locate evidence without help from the system administrator, explain the boundary, and identify which records are current. Capture unresolved questions as owner-and-date actions. A useful result is not a perfect mock score; it is a practical list of documents to correct, controls to fix, and demonstrations to rehearse. This approach also makes the actual Government review less dependent on the one employee who remembers where everything lives.
Checklist before a Medium or High assessment
A one-page handoff can prevent avoidable confusion on assessment day. Keep the procurement version and amendments, the applicable clause text, system boundary diagram, SSP version, assessment history, SPRS record, CAGE-code mapping, and the current action plan together. Assign one person to manage requests and one qualified owner for each technical area. Confirm what the team may demonstrate, which data must be masked, and how questions that appear outside the documented boundary will be escalated.
After the assessment, record the completion date immediately and calendar the 14-business-day response deadline. Route every proposed rebuttal through security, contracts, and the executive owner before submission. If a finding is accurate, send it to remediation with a target date rather than trying to disguise it as a wording dispute. If it appears inaccurate, preserve contemporaneous facts and respond narrowly to what the team observed.
A short working check
- ✓Confirm that the contract contains the current Part 240 clause text and amendments.
- ✓Map the clause to the covered system under 252.204-7012 and the SSP.
- ✓Reconcile SPRS score, assessment date, CAGE codes, and expected completion date.
- ✓Assign access, evidence, facility, and technical owners.
- ✓Calendar the 14-business-day post-assessment response window.
Common questions
Does 252.240-7997 mean every defense contractor will get a High Assessment?
No. The clause describes the Government’s Medium and High assessment processes and their access requirements. Whether it applies to a particular contractor and system depends on the contract language and the clause’s applicability to a covered system required to comply with 252.204-7012.
Is this the same as a CMMC certification assessment?
No. A NIST SP 800-171 DoD Assessment and a CMMC status are distinct records under different provisions. A contract may require both, so map each requirement separately.
Can we use the 14 business days to fix a missing safeguard?
The clause describes providing additional information about requirements not observed or rebutting questioned findings. It is not a blanket remediation extension. Be accurate about what was implemented during the assessment.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
