The clause numbers changed. Your obligations did not. If you handle CUI, you still self-assess against NIST SP 800-171 Rev 2, post your score to SPRS, and meet CMMC Level 2 — just under new clause numbers on new contracts.
On February 1, 2026, the Department of War (DoW) implemented Class Deviation 2026-O0025 — the "Revolutionary FAR Overhaul" (RFO) — which stood up a new DFARS Part 240 for cybersecurity clauses and moved the FCI safeguarding clause into the new FAR Part 40. The practical effect for defense contractors: several familiar CMMC-related clause numbers were deleted or renumbered. Nothing about what you actually have to do changed — but the numbers you'll see in solicitations did. Here's the map.
What changed — the clause map
Four clauses moved or were removed; two stayed exactly where they were. This table is the whole story:
| Old clause | What happened | New number |
|---|---|---|
| DFARS 252.204-7019 | Deleted. Its "Basic" self-assessment posting role is now handled under the CMMC framework. | — (removed) |
| DFARS 252.204-7020 | Renumbered and rewritten. The new clause covers only government-performed Medium/High assessments (NIST SP 800-171A); it no longer defines a "Basic" self-assessment. | 252.240-7997 |
| FAR 52.204-21 | Renumbered. The Level 1 / FCI "Basic Safeguarding" clause moved into the new FAR Part 40. | 52.240-93 |
| DFARS 252.204-7012 | Unchanged. Safeguarding CUI & cyber-incident reporting is exactly where it was. | 252.204-7012 |
| DFARS 252.204-7021 | Unchanged. The CMMC requirement clause — the one that carries your required level into a solicitation — keeps its number. | 252.204-7021 |
What the 7997 rewrite actually says
Beyond the new number, DFARS 252.240-7997 was rewritten. The updated text defines only Medium and High assessments — both government-performed, using the NIST SP 800-171A assessment procedures. The old "Basic" (contractor self-assessment) definition is gone from this clause. That does not mean self-assessments disappeared: if a contract requires CMMC Level 2 (Self), your self-assessment obligation lives in the CMMC program itself (DFARS 252.204-7021), not in 7997.
What did NOT change (and this matters most)
- Your CMMC level and path. Handle CUI → still Level 2. The requirement still arrives as a 252.204-7021 clause in the solicitation.
- Self-assessment + SPRS. You still score yourself against all 110 controls, post the result to SPRS, and affirm continuous compliance.
- The scoring standard. SPRS and CMMC scoring remain on NIST SP 800-171 Revision 2 — the DoW has not moved scoring to Rev 3.
- DFARS 252.204-7012. Safeguarding CUI and 72-hour incident reporting are unchanged.
New numbers, same 110 controls — see where you stand
The clauses moved; the controls didn't. Score yourself against all 110 in about 10 minutes, free and in your browser.
Calculate your SPRS score →What to do now
- Read the actual clause numbers on your solicitation. New award → expect 252.240-7997 / 52.240-93. Existing contract → the old numbers still apply.
- Update your templates carefully. Add the new numbers alongside the old — don't delete the legacy references you still cite on active contracts. (Our Starter Kit documents both.)
- Keep executing. Self-assess with the free SPRS calculator, draft your SSP, and track gaps on a POA&M. The renumbering changes none of it.
FAR Overhaul & clause renumbering — FAQ
What is DFARS 252.240-7997?
It's the renumbered, rewritten home of the former DFARS 252.204-7020. Effective Feb 1, 2026 under new DFARS Part 240, it covers only government-performed Medium/High NIST SP 800-171A assessments — the "Basic" self-assessment definition was removed from the clause.
Did my CMMC requirement change?
No. The numbers moved; your obligations didn't. Level 2 (Self) still means self-assess, post to SPRS, and affirm — under the unchanged CMMC clause, DFARS 252.204-7021.
Do I use 7020 or 7997?
Depends on the contract. Solicitations issued on/after Feb 1, 2026 use 252.240-7997; older/existing contracts keep 252.204-7020. Both are valid depending on vintage.
What replaced FAR 52.204-21?
FAR 52.240-93, under the new FAR Part 40. It's the same Level 1 / FCI "Basic Safeguarding" clause, renumbered. New solicitations use 52.240-93; older ones keep 52.204-21.
Did 7012 or the scoring standard change?
No. DFARS 252.204-7012 is unchanged, and SPRS/CMMC scoring still runs on NIST SP 800-171 Revision 2.
Keep going where it's free
Numbers change; the controls don't. Calculate your SPRS score, then draft your SSP — both free, both in your browser. New to the phases? See the CMMC timeline.