<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_252.204-7021"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">252.204-7021</ph> Cybersecurity Maturity Model Certification Requirements.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">As prescribed in 204.7503(a)
and (b), insert the following clause:</p>
         <p outputclass="Ctr_SmCaps" class="- topic/p ">CYBERSECURITY
MATURITY MODEL CERTIFICATION REQUIREMENTS (JAN 2023)</p>
         <p outputclass="List1" class="- topic/p ">(a) <i class="+ topic/ph hi-d/i ">Scope.</i> The
Cybersecurity Maturity Model Certification (CMMC) CMMC is a framework
that measures a contractor’s cybersecurity maturity to include the
implementation of cybersecurity practices and institutionalization
of processes (see <xref href="https://www.acq.osd.mil/cmmc/index.html"
                  format="html"
                  scope="external"
                  class="- topic/xref ">https://www.acq.osd.mil/cmmc/index.html</xref>).</p>
         <p outputclass="List1" class="- topic/p ">(b) <i class="+ topic/ph hi-d/i ">Requirements</i>.
The Contractor shall have a current (i.e. not older than 3 years)
CMMC certificate at the CMMC level required by this contract and
maintain the CMMC certificate at the required level for the duration
of the contract.</p>
         <p outputclass="List1" class="- topic/p ">(c) <i class="+ topic/ph hi-d/i ">Subcontracts</i>.
The Contractor shall—</p>
         <p outputclass="List2" class="- topic/p ">(1) Insert the substance of this clause, including this paragraph (c), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items; and</p>
         <p outputclass="List2" class="- topic/p ">(2) Prior
to awarding to a subcontractor, ensure that the subcontractor has
a current (i.e., not older than 3 years) CMMC certificate at the
CMMC level that is appropriate for the information that is being
flowed down to the subcontractor.</p>
      </conbody>
   </concept>
</dita>
