StacksVerified U.S. regulatory reference

48 CFR §204.7502

Verified against eCFR.gov as of June 20, 2026View official text on eCFR.gov ↗
  1. (a)When a requiring activity identifies a requirement for a contract, task order, or delivery order to include a specific CMMC level, the contracting officer shall not—
    1. (1)Award to an offeror that does not have a CMMC certificate at the level required by the solicitation; or
    2. (2)Exercise an option or extend any period of performance on a contract, task order, or delivery order unless the contractor has a CMMC certificate at the level required by the contract.
  2. (b)Contracting officers shall use Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to verify an offeror or contractor's CMMC level.