# DoD Revises FAR Cybersecurity Clause

The Department of Defense implemented a significant revision to the Federal Acquisition Regulation (FAR) in February 2026, replacing DFARS clause 252.204-7019 with 252.204-7997. This change expands the government's authority to conduct a more thorough review of contractors' compliance with NIST SP 800-171 cybersecurity requirements, including examination of System Security Plans (SSP), processes, and procedures beyond relying solely on third-party CMMC Level 2 assessments. Early feedback from the contracting community indicates limited visibility of this new clause in solicitations to date, raising questions about the extent and rigor of government verification efforts.

- **Why this matters:** Procurement professionals and contractors should anticipate enhanced government scrutiny of cybersecurity compliance documentation, which may affect proposal preparation and contract award evaluations.
- Organizations must ensure comprehensive and verifiable NIST 800-171 implementation evidence is maintained and readily available for government review.
- This revision signals a shift from procedural certification reliance toward substantive operational verification, potentially impacting contract eligibility and risk assessments.
- Companies should update internal compliance programs and engage with contracting officers to clarify expectations under the new clause.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** July 09, 2026

### Government Entities
- Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Key Quotes
> DFARS 252.204-7019 is essentially replaced with 252.204-7997 giving the government authority to review a company’s implementation of NIST 800-171 supporting evidence to include SSP, processes and procedures all of which to verify operations at the reported level.
> — Original poster

### Sources
- [2026 FAR Overhaul Class Deviation … What Next](https://www.reddit.com/r/CMMC/comments/1urml8m/2026_far_overhaul_class_deviation_what_next) - reddit-cmmc