48 CFR § 204.7504 - 204.7504 Solicitation provision and contract clause.

---
identifier: "/us/cfr/t48/s204.7504"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "48 CFR § 204.7504 - 204.7504   Solicitation provision and contract clause."
title_number: 48
title_name: "Federal Acquisition Regulations System"
section_number: "204.7504"
section_name: "204.7504   Solicitation provision and contract clause."
chapter_number: 2
chapter_name: "DEFENSE ACQUISITION REGULATIONS SYSTEM, DEPARTMENT OF DEFENSE"
subchapter_number: "A"
subchapter_name: "GENERAL"
part_number: "204"
part_name: "ADMINISTRATIVE AND INFORMATION MATTERS"
positive_law: false
currency: "2026-03-24"
last_updated: "2026-03-24"
format_version: "1.1.0"
generator: "[email protected]"
authority: "41 U.S.C. 1303 and 48 CFR chapter 1."
regulatory_source: "56 FR 36289, July 31, 1991, unless otherwise noted."
cfr_part: "204"
---


# 204.7504 204.7504   Solicitation provision and contract clause.

(a) Unless the requirements at 32 CFR 170.5(d) are met, use the clause at 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, as follows:

(1) Until November 9, 2028, in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of commercially available off-the-shelf (COTS) items, if the program office or requiring activity determines that the contractor is required to have a specific CMMC level.

(2) On or after November 10, 2028, in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of COTS items, if the program office or requiring activity determines that the contractor is required to use contractor information systems in the performance of the contract, task order, or delivery order to process, store, or transmit FCI or CUI.

(b) Use the provision at 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements, in solicitations that include the clause at 252.204-7021.