DFARS 204.7500 — Scope of subpart
Regulatory text. Not legal advice.
(a)
(a) This subpart prescribes policies and procedures for including the Cybersecurity Maturity Model Certification (CMMC) level requirements in DoD contracts. CMMC is a framework (see 32 CFR FAR Part 170) for assessing a contractor’s information security protections.
(b)
(b) This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program.
(c)
(c) This subpart applies to unclassified contractor information systems.
Source: eCFR • Pulled 2026-04-16