<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_204.7503"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">204.7503</ph> Contract clause.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">Use the clause at 
               <xref href="252.204-7021.dita#DFARS_252.204-7021"
                  base="i1380987"
                  outputclass="fm:ParaNumOnly"
                  class="- topic/xref ">252.204-7021</xref>
            , Cybersecurity
Maturity Model Certification Requirements, as follows:</p>
         <p outputclass="List1" class="- topic/p ">(a) Until
September 30, 2025, in solicitations and contracts or task orders
or delivery orders, including those using FAR part 12 procedures
for the acquisition of commercial items, except for solicitations
and contracts or orders solely for the acquisition of commercially
available off-the-shelf (COTS) items, if the requirement document
or statement of work requires a contractor to have a specific CMMC
level. In order to implement a phased rollout of CMMC, inclusion
of a CMMC requirement in a solicitation during this time period
must be approved by OUSD(A&amp;S).</p>
         <p outputclass="List1" class="- topic/p ">(b) On
or after October 1, 2025, in all solicitations and contracts or
task orders or delivery orders, including those using FAR part 12
procedures for the acquisition of commercial items, except for solicitations
and contracts or orders solely for the acquisition of COTS items.</p>
      </conbody>
   </concept>
</dita>
