As of February 1, 2026, defense contractors are no longer required to conduct basic self-assessments and upload their scores into SPRS pursuant to DFARS provision 252.204-7019 and DFARS clause 252.204-7020, largely because DFARS 7019 and 7020 no longer exist at all. This is thanks to a DFARS class deviation, DFARS clause 252.240-7997 called NIST SP 800-171 DoD Assessment Requirements.
On top of that, you won’t see FAR clause 52.204-21 either because it has a new number: 52.240.93. If all that isn’t exciting enough, all of this happened without rulemaking.
So, what’s going on? Why are we on this rollercoaster, and how did it kill DFARS 7019 and 7020? Here’s what you need to know about the recent changes made under the Revolutionary FAR Overhaul (RFO).
1) FAR clause 52.204-21 is renumbered to 52.240-93
2) DFARS provision 252.204-7019 no longer exists.
3) DFARS clause 252.204-7020 has been renumbered, and self-assessment requirements have been removed.
4) There are no changes to DFARS clause 252.204-7012 or provision 252.204-7008.
5) There are no changes to DFARS clause 252.204-7021 or provision 252.204-7025.
The Federal Acquisition Regulation (FAR) has been the framework for how the government makes purchases for the last 40 years, codified under Chapter 1 of Title 48 of the Code of Federal Regulations.
Issued jointly by the FAR Council, the GSA, NASA, and the DoW, the FAR is the primary regulation used by all executive agencies in their acquisition of supplies and services with appropriated funds.
It includes standard solicitation provisions and contract clauses and various agency “supplements” such as the DFARS – the Defense FAR Supplement.
Note: This is why the full title of a clause like DFARS 7012 is 48 CFR 252.204-7012.
Naturally, the FAR and the agency supplements are complex, but they have reached thousands of pages long and continue to grow year over year. In response to that problem and added policy, the Office of Federal Procurement Policy got to work on cutting through the noise.
In August of 2025, the Office of Federal Procurement Policy launched a massive deregulation effort known as the “Revolutionary FAR Overhaul” (RFO). This is the first major overhaul and the largest single update to the FAR in its 40-year history.
The overarching goal is to rewrite the FAR in “plain language” and remove most text that isn’t:
Under the RFO, up to 1/3 of the FAR could be removed entirely.
The policy basis for this effort goes all the way to the top:
Since August, every part of the FAR has gone under the microscope. You can see the changes to every subpart, section, and subsection on the RFO website.
You’re probably wondering how we’ve gotten this far without addressing rulemaking. How are they changing regulations without the rulemaking process?
A class deviation is a formal, temporary authorization that allows federal agencies to bypass, alter, or ignore parts of the FAR or agency supplements.
The original 2020 CMMC rule said to insert clause 252.204-7021 in all solicitations and contracts starting October 1st, 2025. The problem was the CMMC 2.0 rulemaking would go into effect after that so contracting officers would be inserting outdated clause language.
So, in August 2025, the DoW issued a deviation that said contracting officers shall not use the 7021 clause until the effective date of the CMMC final rule, which became November 10th, 2025.
DFARS 7012 requires implementing the most current version of NIST SP 800-171 at the time of solicitation (currently 171, revision 3). However, CMMC is pinned to a specific version, currently 171 revision 2, meaning DFARS 7012, as codified, requires implementing a version of 171 that CMMC doesn’t assess.
The DoW didn’t foresee that issue when they revised 7012 in 2016, so they issued a class deviation in May 2024, saying to ignore the text of 7012 as written at 48 CFR 252.204-7012 and use this deviation text specifying revision 2 instead. (This is why we called that podcast episode “Crisis Averted.”
Note: If you google 7012 you see the original text from 2016 because it hasn’t been changed via rulemaking, even though deviation text is what appears in contracts.
Now, imagine class deviations in place for every single part of the FAR and all the agency supplements.
You can still find FAR 52.204-21 and DFARS 252.204-7019, for instance, even though the deviation text changed them on February 1st.
Eventually, all of these changes will go through rulemaking, probably all at once. In the meantime, these changes are being published as class deviations first, enabling agencies to “begin using the streamlined FAR part until the FAR is revised through the formal rulemaking process,” according to the GSA.
The FAR overhaul includes changes to FAR clause 52.204-21 Basic Safeguarding for Covered Contractor Information Systems. Thanks to the overhaul of FAR Part 52 Solicitations and Contract Clauses, the clause 52.204-21 is renumbered to 52.240-93.
Since 2016 this clause has imposed 15 cybersecurity requirements on federal contractors when the contractor or subcontractor at any tier handles Federal Contract Information. Despite the renumbering, 52.240-93 will maintain the same title, text, and requirements.
CMMC Level 1 assesses those requirements but will still reference 52.204-21 so be aware. Until rulemaking codifies the class deviations, we’ll all need to juggle both numbers for the same clause.
On February 1st, 2026, 38 different DFARS class deviations went into effect to match overall FAR deviations.
Under these deviations, DFARS provision 252.204-7019 no longer exists.
DFARS clause 252.204-7020 has two changes.
All other parts of the clause are the same, including:
Though the RFO kills DFARS 7019 (RIP), the changes it brings continue to reinforce practical, compliant DoW procurement within a more streamlined FAR.
With more changes underway, it’s more important than ever to stay informed.
Reach out to a Summit 7 expert to learn more about implementing CMMC compliance in your organization.