Recent Changes to DFARS Clauses 

If your subcontract templates or your purchasing system still reference DFARS 252.204-7019, you are already working from a clause that no longer exists. The same is probably true of whatever clause number your quality manual cites for the basic NIST SP 800-171 self-assessment. 

Since February 1, 2026, a large share of DFARS clauses have new numbers, new locations in the regulation, and in a handful of cases, new substance. The changes come from the Revolutionary FAR Overhaul, an effort large enough that people who track this for a living have had to slow down and relearn where things live. This isn’t a rumor circulating on LinkedIn. It’s a real, ongoing rewrite that DoD is implementing through class deviations ahead of formal rulemaking, and it is not finished. 

None of this means your obligations disappeared. It means the map changed, and a flowdown clause package or purchasing system built against the old map now has gaps that a CPSR reviewer or a prime’s supplier quality team can spot in about five minutes. Here’s what actually changed, what didn’t, and what to check in your own paperwork. 

The Revolutionary FAR Overhaul, in Plain Terms 

The Office of Federal Procurement Policy launched the Revolutionary FAR Overhaul in August 2025, under Executive Order 14265 and OMB Memorandum M-25-26. The stated goal is to rewrite the FAR in plain language and strip out text that isn’t doing real work, with estimates that as much as a third of the FAR could be removed outright. It’s the largest single rewrite of federal acquisition regulations in more than 40 years. 

DoD is implementing its share of this through class deviations, which let contracting officers use the new language before the formal rulemaking process catches up. The first wave, covering roughly 31 DFARS Parts, was announced in December 2025 and took effect February 1, 2026. DoD has kept issuing revisions since. A further update to DFARS Part 205 came in August 2026, implementing an FY 2025 NDAA notice requirement for small business concerns. Treat this as a process running through the rest of 2026, not a single event you can check off. 

One distinction matters more than any specific clause number: most of what’s happening is administrative consolidation, not new obligations. A clause moving from one number to another doesn’t automatically mean the requirement changed. A few of the changes are substantive. Knowing which is which is the actual work. 

The Cybersecurity Renumbering, Which Is the One Most Likely to Bite You 

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, is now FAR 52.240-93. Same title, same 15 requirements, new number. If your purchasing system or CMMC Level 1 self-assessment references the old number, the obligation is identical, but your paperwork should point to the new one. 

DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, has been eliminated outright. It no longer exists as a standalone clause. 

DFARS 252.204-7020 has been renumbered to DFARS 252.240-7997, and this one is a real substantive change, not just a number swap. The revised clause drops the “Basic” self-assessment concept entirely. It now defines only Medium and High assessments, and both of those are government-performed, not contractor self-attested. 

DFARS 252.204-7021, the CMMC clause, still exists. Its prescription now sits at DFARS 204.7504(a), and the clause text itself was refreshed with a November 2025 date. Practically, if you’re a subcontractor who has been self-assessing against NIST SP 800-171 and posting a score to SPRS, that obligation didn’t go away. It moved under the CMMC clause framework rather than living in its own standalone clause. 

Other Renumbered Clauses Worth Checking For 

DFARS 252.237-7000, Notice of Special Standards of Responsibility, is now 252.237-7997. The text is essentially unchanged, aside from an updated reference for obtaining Government Auditing Standards. 

DFARS 252.237-7019, Training for Contractor Personnel Interacting with Detainees, is now 252.237-7998, with an updated PGI reference inside the clause. 

Neither of those is dramatic on its own. But if you built any internal system, a clause matrix, a checklist, a template library, that keys off exact clause numbers, every one of those internal references is now stale even though the underlying requirement hasn’t moved an inch. Multiply that across a purchasing system with years of accumulated PO templates, and the reconciliation work adds up. 

Where the Renumbering Isn’t Just Renumbering 

Two changes carry actual substance, and both work in your favor. 

The certified cost or pricing data threshold is rising to $10 million. Under Section 1804(c) of the FY 2026 NDAA, the threshold that triggers Truthful Cost or Pricing Data submission (the requirement most people still call TINA, from its old name) applies the new $10 million line to contracts entered into after June 30, 2026, up from $2 million. Alongside it, DFARS 215 procedural guidance is being reorganized into the PGI, and the cost estimating system requirements clause at DFARS 252.215-7002 has been retained with an updated definition of “material weakness.” 

Nontraditional defense contractor status now carries broader exemptions. FY 2026 NDAA Section 1826 exempts nontraditional defense contractors from certified cost or pricing data submission and related FAR Part 31 cost principle requirements, layered on top of the higher dollar threshold above. Between the two, a meaningful number of Tier II through Tier IV suppliers have less certified-cost exposure than they did a year ago, not more. 

If your compliance messaging, or your own internal risk assessment, still assumes every subcontract above a small dollar figure faces full cost-data exposure, that assumption is worth revisiting against the current thresholds before you scope your next system review. 

If You Manage Flowdowns, Here’s the Practical Problem 

Contracts awarded before February 1, 2026 legitimately cite the old clause numbers. New solicitations cite the new ones. A purchasing system built to match clause packages on number alone is going to show mismatches over the next year or two that aren’t actually errors, they’re just contracts on different sides of the transition. 

The practical move isn’t to find-and-replace every old clause number in your templates and call it done. It’s to confirm which clause set actually governs each prime contract, based on award date and what the prime’s own PO language says, and keep both the old and new numbers live in your reference library while the transition plays out. And before you treat a clause’s presence or absence in a flowdown package as a compliance finding, confirm whether the discrepancy is a real substantive change or just the renumbering catching up to a contract that predates it. 

Where This Goes Wrong 

Treating a renumbered clause as a new clause. Most of what changed on February 1, 2026 is where a requirement lives, not what it requires. Flagging DFARS 252.240-7997 as a new obligation your subcontractors haven’t agreed to, when it’s the same requirement as the old 252.204-7020 minus the basic self-assessment language, wastes everyone’s time and erodes trust with suppliers who are told to sign something they think is new. 

Treating this as a one-time update. DoD has issued revisions on a rolling basis since December 2025, and the August 2026 update to Part 205 shows the process is still active. A clause matrix updated once in February and never touched again will be out of date again before the end of the year. 

Assuming the elimination of DFARS 252.204-7019 means the self-assessment obligation went away. It didn’t. It moved under the CMMC clause at 252.204-7021. Contractors who read the elimination of 7019 as good news and stopped tracking their SPRS score are heading toward a finding, not away from one. 

Where GovComply Fits 

This is exactly the kind of change that gets lost between an annual policy review and a contract file nobody reopens until an audit. GovComply.ai tracks the clause language and prescription actually in force for each contract in the platform, tied to that contract’s award date, so a clause package built for a pre-overhaul contract isn’t silently compared against post-overhaul clause text. 

Every determination carries its regulatory basis in the record, so when a clause number changes out from under you, the reasoning for what’s in a given flowdown package is documented rather than reconstructed from memory during a review. Active monitoring that automatically flags contracts affected by a regulatory change like the FAR Overhaul, checked against acquisition.gov, is on the roadmap for Q4 2026. Today, the platform’s strength is making sure each contract’s clause determinations are documented and traceable, which is most of the battle when a reviewer asks why a number in your file doesn’t match what they’re looking at. 

If you haven’t reconciled your purchasing system or subcontract templates against the DFARS renumbering yet, the free contract analysis is a fast way to find out where the stale references are. 

GovComply.ai is compliance software built for defense and aerospace manufacturers holding government contracts.