FAR 52.240-93 replaces 52.204-21: what changed for CMMC

If you open the FAR today to read the Level 1 safeguarding clause, you will not find it at 52.204-21. Under the Revolutionary FAR Overhaul it sits at 52.240-93, and the DFARS clauses behind CMMC have moved with it: subpart 204.73 is now 240.370, subpart 204.75 is now 240.371, and the assessment clause 252.204-7020 has been replaced by 252.240-7997. Clause 252.204-7012 and clause 252.204-7021 keep their numbers. None of this has reached the documents the CCP exam is written from: ISACA's 2026 outline, 32 CFR Part 170, the Level 1 Assessment Guide and the candidate guide all still say 52.204-21 and 7012. This article sets out what moved, by which instrument, what did not move, and which numbers to learn for the exam.

What moved, and when

The civilian side first. The overhaul publishes rewritten FAR parts on acquisition.gov as deviation text, which agencies adopt in place of the codified text. Its new Part 40, Information Security and Supply Chain Security, carries the safeguarding clause under a new number: "40.303-2 Contract clause. Insert the clause at 52.240-93, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or moving through its information system." In the overhaul's Part 52, 52.204-21 is marked "[Reserved]" and the clause text appears at 52.240-93.

Then the Department. DoD Class Deviation 2026-O0025, "Revolutionary Federal Acquisition Regulation (FAR) Overhaul Part 40, Defense FAR Supplement (DFARS) Part 240", signed on December 18, 2025, directs that "Effective February 1, 2026, contracting officers shall use" the revised FAR Part 40 "in lieu of the text codified at 48 CFR chapter 1", together with "The attached new DFARS Part 240, Information Security and Supply Chain Security". The deviation "remains in effect until rescinded or incorporated into the FAR, DFARS, and DFARS PGI."

The attached Part 240 moves the two CMMC subparts. "240.370 Safeguarding Covered Defense Information and Cyber Incident Reporting" is the former 204.73, and "240.371 Cybersecurity Maturity Model Certification" is the former 204.75. The prescriptions under 240.370 insert provision 252.204-7008, clause 252.204-7009, clause 252.204-7012 and a new clause, "252.240-7997, NIST SP 800-171 DoD Assessment Requirements". The prescriptions under 240.371 insert "the clause at 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements" and "the provision at 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements". Provision 252.204-7019 and clause 252.204-7020 are not among them.

What the new numbers contain

52.240-93 is 52.204-21 under a new number. The clause's safeguarding paragraph reads: "The Contractor shall safeguard its covered contractor information systems by implementing, at minimum, the following security controls", and the fifteen that follow, (i) to (xv), are the FAR's fifteen word for word, from "Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)" to the periodic and real-time scans. The paragraph structure is the same too, so the Level 1 guide's identifiers, AC.L1-b.1.i through SI.L1-b.1.xv, still point at the right text. CMMC Level 1: 15 or 17? walks the fifteen.

252.240-7997 is the assessment clause without the self-reported score. The new clause defines a High Assessment and a Medium Assessment, both "conducted by Government personnel", and requires the contractor to "provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, using the methodology described at 32 CFR 170.24, if necessary." The Basic Assessment that clauses 7019 and 7020 built on, the contractor's own score posted to SPRS, is not defined in it. The clause also says that Medium and High results, "when conducted by DCMA, will take precedence over any other assessment", and that summary level scores "will be posted in the Supplier Performance Risk System (SPRS)".

240.371 is the CMMC subpart, unchanged in substance. It opens: "This section prescribes policies and procedures for including the Cybersecurity Maturity Model Certification (CMMC) level requirements in DoD contracts. CMMC is a framework (see 32 CFR part 170) for assessing a contractor's information security protections." Clause 7021 still carries the contractor's CMMC obligations, and the provision 7025 still gives notice of the level required.

What did not move: the program rule and the exam's documents

The deviation changes the acquisition regulations, which put CMMC into contracts. It does not touch 32 CFR Part 170, the program rule, which defines Level 1 by "48 CFR 52.204–21(b)(1)(i) through (xv)" and maps those paragraphs to NIST in its own table. It does not touch the Level 1 Assessment Guide, which numbers its requirements after the same paragraphs. And it does not touch ISACA's 2026 exam outline, whose Domain 3 names "DFARS Clause 252.204-7012" and "FAR Clause 52.204-21" by their old numbers, and the Department's own CMMC page still describes Level 1 as compliance with "the 15 security requirements in FAR clause 52.204-21".

So the exam's vocabulary is the old vocabulary, by the exam's own design: it tests the documents as they stand, and those documents have not been reissued. The Department's July 2026 suspension of Phase 2 did not change them either; Is the CCP worth it after the Phase 2 pause? covers that.

What to learn for the exam

• Learn 52.204-21 as the name of the Level 1 clause, because that is what the outline, the rule and the guides say, and know that the FAR now prints the same clause at 52.240-93. A question that names either is asking about the same fifteen safeguards.
• Learn 7012 and 7021 as they are. Both kept their numbers and their content. 7012 is the clause the outline names; 7021 is the clause that requires a CMMC Status.
• Know that 7019 and 7020 were the SPRS self-assessment clauses, and that the deviation replaced 7020 with 252.240-7997 and left 7019 out. The exam's documents still describe the SPRS score they produced, and the rule's definitions still cite 7020 for the DCMA DIBCAC High Assessment.
• Expect no question to turn on the new numbers yet. Nothing in the 2026 outline or candidate guide names them. When ISACA reissues the outline or the Department amends the rule, that will change; until then, the old numbers are the exam's numbers.

For the site's own readers

Every lesson here that introduces a clause names it as the exam's documents do, and the lessons on the regulatory chain and FCI and CUI now carry a dated note on the renumbering, with this article as the place it is explained. What to read for the CCP exam lists the clauses among the documents to read; read them under either number, and keep both in mind.