FAR / DFARS COMPLIANCE

The FAR and DFARS clauses a small business actually carries

Every federal contract carries a clause list, and most of it is boilerplate nobody has to act on. A smaller set creates real, recurring obligations: safeguarding covered information, flowing terms down to subcontractors, reporting, and keeping records that survive an audit. This page separates the two.

THE SHORT ANSWER

A clause list is mostly boilerplate, but a small set creates recurring obligations: limitations on subcontracting, wage requirements, accelerated payment to small-business subcontractors, first-tier subcontract reporting, and basic safeguarding. For DoD work, add the NIST SP 800-171 and CMMC clauses. Two things are worth knowing before you act on any summary. The 2025-26 FAR overhaul is not codified, so two different FAR texts are in circulation and which one binds you depends on the agency. And several thresholds in the regulation no longer match the statute that governs them.

A clause list is mostly boilerplate. A small part of it is not

Every federal award carries a list of incorporated clauses, and most of them impose nothing you have to do. A much smaller set creates recurring obligations: safeguarding information, flowing terms down to subcontractors, reporting, paying at specified rates, and keeping records that survive an audit.

The practical problem is that the two groups are not labeled differently. A firm signing its first federal contract sees fifty clause numbers and no indication of which five will generate work. What follows is the short list, with the citation so you can read the actual text.

One more thing before the list: whether a given clause binds you can depend on the agency. FAR clauses apply government-wide. DFARS clauses apply only to DoD components. If you are selling to the Department of Veterans Affairs or the Department of Energy, a different supplement may apply instead.

The clauses that create real, recurring work

These are the ones that turn into calendars, deliverables, and audit exposure rather than a line in an attachment.

52.219-14 — Limitations on Subcontracting (OCT 2022): Caps how much a small-business prime may pay to subcontractors that are not similarly situated. The percentages differ by category: 50 percent for services and supplies, 85 percent for general construction, 75 percent for special trade contractors. For construction the base EXCLUDES the cost of materials, so it is not 85 percent of contract price. This clause was NOT recodified as 52.219-33; that is a different, pre-existing clause. acquisition.gov/FAR/52.219-14.
52.219-9 — Small Business Subcontracting Plan: Required of other-than-small primes at $900,000 ($2,000,000 for construction). The clause itself does not apply to small businesses, and a plan is not required from them. Firms often assume the reverse. acquisition.gov/FAR/19.702.
52.219-33 — Nonmanufacturer Rule (SEP 2021): Separate from 52.219-14 and commonly confused with it. It governs whether a firm that resells another manufacturer's products can still qualify as small for a supply contract. acquisition.gov/FAR/52.219-33.
52.222-6 — Construction Wage Rate Requirements (AUG 2018): The Davis-Bacon clause, renamed years ago: it is no longer titled "Davis-Bacon Act". It applies to construction over $2,000, which is far lower than most people assume. Wages, fringe benefits, and certified payroll become ongoing obligations from day one. acquisition.gov/FAR/22.407.
52.232-40 — Providing Accelerated Payments to Small Business Subcontractors: Requires the prime to pay small-business subcontractors as quickly as it is paid, and it is not optional. It is one of the clauses small primes most often fail to operationalize because it looks like boilerplate. acquisition.gov/FAR/52.232-40.
52.204-21 — Basic Safeguarding of Covered Contractor Information Systems: Fifteen basic safeguarding requirements for any contractor information system that processes covered contractor information, at paragraphs (b)(1) through (b)(15) of the clause. Do not assume a commercial-item carve-out removes it: check the clause list in your own solicitation rather than a general summary. acquisition.gov/FAR/52.204-21.
First-tier subcontract reporting at $40,000: Above this value, the prime reports first-tier subcontract awards in the federal procurement data system. It is a recurring administrative obligation with a deadline, and it falls on the prime. acquisition.gov/FAR/4.1401.

The cyber layer is where DFARS diverges most

If you are selling to DoD, the safeguarding obligations are the part of the contract most likely to create real, dated work. They are also the part most distorted by things written online, so this is worth getting exactly right.

Four clauses are in play, not one. 252.204-7012 imposes the substantive obligation to safeguard covered defense information and to report cyber incidents, and it requires compliance with the NIST SP 800-171 revision in effect at the time of solicitation. 252.204-7019 and 252.204-7020 handle the assessment requirement and the posting of your score. 252.204-7021 is the CMMC compliance clause, added in November 2025.

A caution that matters: do not assume any of these was removed or that the assessment requirement lapsed. All of them are active in the current DFARS. The summary-level score must be posted in the Supplier Performance Risk System and be no more than three years old before award, option exercise, or period-of-performance extension. All four clauses carve out solicitations and contracts solely for commercial off-the-shelf items.

252.204-7012 — Safeguarding and cyber incident reporting (MAY 2024): "Rapidly report" means within 72 hours of discovering an incident, through the DoD cyber incident reporting portal at dibnet.dod.mil. Prescribed at DFARS 204.7304(c). acquisition.gov/DFARS/204.7304.
252.204-7019 and 252.204-7020 — NIST SP 800-171 DoD assessment (NOV 2023): 7019 is the provision giving notice of the assessment requirement; 7020 is the clause requiring the contractor to provide assessment access and to maintain the score. Both remain active.
252.204-7021 — CMMC level requirements (NOV 2025): The CMMC compliance clause, added by the September 2025 DFARS rule effective 10 November 2025, alongside the 252.204-7025 notice provision.
SPRS score currency: The contracting officer must verify a summary-level NIST SP 800-171 score in SPRS that is not more than three years old before award, option exercise, or extension. An expired score stalls a contract action. SPRS (sprs.csd.disa.mil).
Which revision of NIST SP 800-171 applies: The CMMC rule at 32 CFR Part 170 incorporates Revision 2 and states that Revision 3 is not currently applicable to it. DFARS 252.204-7012 separately requires the revision in effect at solicitation. Those can point to different documents, so check both. NIST SP 800-171.

CMMC as it actually stands

CMMC is the single most misdescribed requirement in this space, in both directions: some sources treat it as fully in force, others as canceled. Neither is right.

The program rule at 32 CFR Part 170 was published in October 2024 and took effect in December 2024. The DoD acquisition rule that puts it into contracts was published in September 2025 and took effect in November 2025, which began Phase 1. In Phase 1, solicitations require Level 1 self-assessment or Level 2 self-assessment as conditions of award, and the department may require a Level 2 third-party assessment at its discretion. The later phases, which would have made third-party assessment routine, were scheduled to begin in November 2026.

In July 2026 the Department of War suspended Phase 2 and stood up a reform task force. A class deviation memorandum of 3 September 2026 now directs contracting officers to remove Phase 2 requirements from active solicitations and existing contracts. So a Level 2 C3PAO certification is not currently a contract requirement, and the underlying NIST SP 800-171 and DFARS safeguarding obligations are entirely unaffected by the suspension. Any CMMC statement you read, including this one, should be checked against the current solicitation in front of you.

Program rule: 32 CFR Part 170, published 15 October 2024 at 89 FR 83092, effective 16 December 2024. Note that the September 2025 date often attached to CMMC belongs to the DFARS rule, not this one. 89 FR 83092.
DoD acquisition rule: 90 FR 43560, effective 10 November 2025. Added DFARS subpart 204.75 and clauses 252.204-7021 and 252.204-7025. 90 FR 43560.
Applicability floor: CMMC requirements attach at the micro-purchase threshold, excluding solicitations and contracts solely for commercially available off-the-shelf items.
Phase 2 suspended: Suspended 13 July 2026 with a CMMC Reform Task Force established. The suspension memo itself is not published at a machine-readable government URL, which is worth knowing: reporting on it rests on secondary sources and the accreditation body.

Read the FAR carefully right now, because there are two of them

This is the most important thing on this page and it is almost never mentioned.

In April 2025 an executive order launched a rewrite of large parts of the FAR, restructuring Parts 19, 22, 28, 30, 36 and 52. A search of the Federal Register for final rules implementing it returns nothing: every document is a proposed rule. The rewrite is instead being applied as model deviation text that agencies adopt individually through class deviations.

The consequence is that two materially different FAR texts are in circulation. The codified FAR, updated by the latest Federal Acquisition Circular, is one. The overhauled text, in force at whichever agencies have adopted the deviation, is the other. Whether a given clause number is current for your contract depends on the agency and the solicitation.

The practical rule: read the clause list in the solicitation you are actually bidding, then read that clause in the FAR text the solicitation points to. Do not rely on a summary from a website, a template, or a proposal shop's boilerplate, including ours.

Where the status is published: The FAR Council maintains the overhaul page, a FAQ, and a part-by-part deviation guide. The FAQ states plainly that the rewritten parts are issued as model deviation text expected to be adopted until the FAR is formally revised. acquisition.gov/far-overhaul.

Cost accounting, and the threshold traps

Two regimes cause disproportionate trouble for growing firms, and both currently have regulation and statute saying different things.

Certified cost or pricing data: the FAR threshold is $2.5 million, but the governing statute for DoD contracts already reads $10 million for contracts entered into after 30 June 2026. The civilian-agency statute says $2 million. The FAR has not been conformed. Certified cost or pricing data is also generally not required when adequate price competition establishes a fair and reasonable price, which is the exemption most small firms actually rely on.

Cost Accounting Standards: the regulation's basic applicability threshold tracks the cost-or-pricing-data threshold, so it currently reads $2.5 million. The statute already reads $35 million, and the CAS Board's final rule moves the regulation to $35 million effective 1 October 2026. Full coverage and the Disclosure Statement trigger rises from $50 million to $100 million on the same date. Most importantly for a small business: small businesses are exempt from CAS entirely.

If the answer to "do we need certified data" or "are we CAS-covered" changes your bid, resolve it against the clause in the solicitation and the current threshold, not a remembered number. These moved in October 2025 and are moving again.

Simplified acquisition threshold and micro-purchase threshold: $350,000 and $15,000, both changed effective 1 October 2025. Both figures are in FAR 2.101 along with several higher contingency variants. acquisition.gov/FAR/2.101.
Small businesses are exempt from CAS: 48 CFR 9903.201-1(b)(3) exempts small business concerns from Cost Accounting Standards in full. A firm that grows past its size standard does not get a grace period.
Certified cost or pricing data: FAR says $2.5 million; the DoD statute says $10 million after 30 June 2026; the civilian statute says $2 million. The FAR is not conformed to either statutory change. acquisition.gov/FAR/15.403-4.

Check this against the source, not against us

Every rule above is published by an agency, not by us. Thresholds and clause numbers change, and a summary written today can be wrong next year. Read the primary source before you act on any of it; that is the standard we would hold our own work to.

Nothing on this page is legal, accounting, or tax advice, and reading it creates no engagement.

Where we fit

The clause list is where compliance work starts, not where it ends. ORIENT takes the clauses that actually apply to your contract and walks what each one requires you to have in place. It separates the ones you already satisfy from the ones that need building, into a gap register with owners and costs. That is usually the difference between a compliance binder nobody reads and a program that survives a review. If the target is a DoD award, the cyber clauses are almost always where the real work is, and we scope that honestly rather than selling a 110-control assessment you may not need.

SCHEDULE A 30-MINUTE CALL GET THE BRIEF

Prefer to write first? inquiries@leatherneckconsulting.com.

Also worth reading

SDVOSB CERTIFICATIONSDVOSB and VOSB certification, explained without the sales pitch CONSTRUCTION & EPCWhat federal construction and EPC work asks for that commercial work does not THE OORAH FRAMEWORKHow the work actually runs, phase by phase.