Notice2025-17321
Information Collection Requirement; Defense Federal Acquisition Regulation Supplement (DFARS) Part 204, Contractor Implementation of Cybersecurity Requirements
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 10, 2025
Issuing agencies
Defense DepartmentDefense Acquisition Regulations System
Abstract
The Defense Acquisition Regulations System has submitted to OMB for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.
Full Text
<html>
<head>
<title>Federal Register, Volume 90 Issue 173 (Wednesday, September 10, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 173 (Wednesday, September 10, 2025)]
[Notices]
[Page 43588]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-17321]
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
Defense Acquisition Regulations System
[Docket Number DARS-2025-0137; OMB Control Number 0750-0008]
Information Collection Requirement; Defense Federal Acquisition
Regulation Supplement (DFARS) Part 204, Contractor Implementation of
Cybersecurity Requirements
AGENCY: Defense Acquisition Regulations System, Department of Defense
(DoD).
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: The Defense Acquisition Regulations System has submitted to
OMB for clearance the following proposal for collection of information
under the provisions of the Paperwork Reduction Act.
DATES: Consideration will be given to all comments received by October
10, 2025.
ADDRESSES: Written comments and recommendations for the proposed
information collection should be sent within 30 days of publication of
this notice to <a href="https://www.reginfo.gov/public/do/PRAMain">https://www.reginfo.gov/public/do/PRAMain</a>. Find this
particular information collection by selecting ``Currently under 30-day
Review--Open for Public Comments'' or by using the search function.
You may also submit comments, identified by docket number and
title, by the following method: Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>. Follow the instructions for submitting comments.
FOR FURTHER INFORMATION CONTACT: Tucker Lucas, 571-372-7574, or <a href="/cdn-cgi/l/email-protection#c6b1aeb5e8aba5eba7aaa3bee8a3b5a2e8aba4bee8a2a2eba2a9a2ebafa8a0a9b4aba7b2afa9a8eba5a9aaaaa3a5b2afa9a8b586aba7afaae8abafaa"><span class="__cf_email__" data-cfemail="e99e819ac7848ac488858c91c78c9a8dc7848b91c78d8dc48d868dc480878f869b84889d808687c48a8685858c8a9d8086879aa984888085c7848085">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
Title and OMB Number: Defense Federal Acquisition Regulation
Supplement (DFARS) Part 204, Contractor Implementation of Cybersecurity
Requirements; OMB Control Number 0750-0008.
Type of Request: New submission.
Affected Public: Businesses or other for-profit and not-for-profit
institutions.
Respondent's Obligation: Required to obtain or retain benefits.
Frequency: On Occasion.
Number of Respondents: 1,493.
Responses per Respondent: Approximately 20.75.
Annual Responses: 30,990.
Average Burden per Response: Approximately 0.08 hour.
Annual Burden Hours: 2,582.
Needs and Uses: This information collection implements contractual
reporting requirements related to the DoD policy for the Cybersecurity
Maturity Model Certification (CMMC) (see 32 CFR part 170) and partially
implements section 1648 of the National Defense Authorization Act for
Fiscal Year 2020.
The contract clause at DFARS 252.204-7021 requires the affirming
official of the contractor to complete an affirmation in the Supplier
Performance Risk System (SPRS) to validate the CMMC level of each of
the contractor information systems that will process, store, or
transmit Federal contract information (FCI) or controlled unclassified
information (CUI) and that are used in the performance of the contract.
In addition, the clause requires the contractor to share with DoD any
updates to the CMMC unique identifiers for information systems that
process, store, or transmit FCI or CUI and that are used in the
performance of the contract.
The solicitation provision at DFARS 252.204-7025 requires offerors
to post the results of a CMMC Level 1 or Level 2 self-assessment to
SPRS prior to contract award. The provision also requires offerors to
identify the contractor information systems that will be used to
process, store, or transmit FCI or CUI during performance of a contract
resulting from the solicitation.
DoD uses the information submitted in response to the solicitation
provision at DFARS 252.204-7025 to verify that an offeror's CMMC level
meets the requirement for CMMC in the solicitation and to document the
affirming official statement related to the CMMC status for all
contractor information systems to be used in performance of a contract
resulting from the solicitation. DoD uses the information submitted in
response to the contract clause at DFARS 252.204-7021 to determine,
prior to exercise of an option or extension of a period of performance,
whether a contractor has the required CMMC status for all contractor
information systems relevant to the contract.
DoD Clearance Officer: Mr. Tucker Lucas. Requests for copies of the
information collection proposal should be sent to Mr. Lucas at <a href="/cdn-cgi/l/email-protection#4f38273c61222c622e232a37612a3c2b61222d37612b2b622b202b62262129203d222e3b262021622c2023232a2c3b2620213c0f222e262361222623"><span class="__cf_email__" data-cfemail="a0d7c8d38ecdc38dc1ccc5d88ec5d3c48ecdc2d88ec4c48dc4cfc48dc9cec6cfd2cdc1d4c9cfce8dc3cfccccc5c3d4c9cfced3e0cdc1c9cc8ecdc9cc">[email protected]</span></a>.
Kimberly R. Ziegler,
Editor/Publisher, Defense Acquisition Regulations System.
[FR Doc. 2025-17321 Filed 9-9-25; 8:45 am]
BILLING CODE 6001-FR-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 10, 2025.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.