<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_204.7503"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">204.7503</ph> Contract clause.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">Use the clause at <xref href="252.204-7021.dita#DFARS_252.204-7021"
                  base="i1380987"
                  outputclass="fm:ParaNumOnly"
                  class="- topic/xref ">252.204-7021</xref> , Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement, as follows:</p>
         <p outputclass="List1" class="- topic/p ">(a) Until September 30, 2025, in solicitations and contracts or task orders or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations and contracts or orders solely for the acquisition of commercially available off-the-shelf (COTS) items, if the requirement document or statement of work requires a contractor to have a specific CMMC level. In order to implement a phased rollout of CMMC, inclusion of a CMMC requirement in a solicitation during this time period must be approved by OUSD(A&amp;S).</p>
         <p outputclass="List1" class="- topic/p ">(b) On or after October 1, 2025, in all solicitations and contracts or task orders or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations and contracts or orders solely for the acquisition of COTS items.</p>
      </conbody>
   </concept>
</dita>
