<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_252.204-7021"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">252.204-7021</ph> CybersecurityMaturity Model Certification Requirements.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">As prescribed in 204.7503(a)
and (b), insert the following clause:</p>
         <p outputclass="Ctr_SmCaps" class="- topic/p ">CYBERSECURITY
MATURITY MODEL CERTIFICATION REQUIREMENTS (NOV 2020)</p>
         <p outputclass="List1" class="- topic/p ">(a) <i class="+ topic/ph hi-d/i ">Scope.</i> The
Cybersecurity Maturity Model Certification (CMMC) CMMC is a framework
that measures a contractor’s cybersecurity maturity to include the
implementation of cybersecurity practices and institutionalization
of processes (see <xref href="https://www.acq.osd.mil/cmmc/index.html"
                  format="html"
                  scope="external"
                  class="- topic/xref ">h<?FM MARKER [Hypertext] message URL https: www.acq.osd.mil cmmc index.html?>ttps://www.acq.osd.mil/cmmc/index.html</xref>).</p>
         <p outputclass="List1" class="- topic/p ">(b) <i class="+ topic/ph hi-d/i ">Requirements</i>.
The Contractor shall have a current (i.e. not older than 3 years)
CMMC certificate at the CMMC level required by this contract and
maintain the CMMC certificate at the required level for the duration
of the contract.</p>
         <p outputclass="List1" class="- topic/p ">(c) <i class="+ topic/ph hi-d/i ">Subcontracts</i>.
The Contractor shall—</p>
         <p outputclass="List2" class="- topic/p ">(1) Insert
the substance of this clause, including this paragraph (c), in all
subcontracts and other contractual instruments, including subcontracts
for the acquisition of commercial items, excluding commercially
available off-the-shelf items; and</p>
         <p outputclass="List2" class="- topic/p ">(2) Prior
to awarding to a subcontractor, ensure that the subcontractor has
a current (i.e., not older than 3 years) CMMC certificate at the
CMMC level that is appropriate for the information that is being
flowed down to the subcontractor.</p>
      </conbody>
   </concept>
</dita>
