{"data":{"id":"us/48-cfr-204.7303","jurisdiction":"us","citation":"48 CFR 204.7303","heading":"204.7303 Procedures.","body":"(a) Follow the procedures relating to safeguarding covered defense information at PGI 204.7303.\n(b) The contracting officer shall verify that the summary level score of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old, unless a lesser time is specified in the solicitation) (see 252.204-7019) for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order are posted in Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/), prior to—\n(1) Awarding a contract, task order, or delivery order to an offeror or contractor that is required to implement NIST SP 800-171 in accordance with the clause at 252.204-7012; or\n(2) Exercising an option period or extending the period of performance on a contract, task order, or delivery order with a contractor that is that is required to implement the NIST SP 800-171 in accordance with the clause at 252.204-7012.","path":["Title 48—Federal Acquisition Regulations System","CHAPTER 2—DEFENSE ACQUISITION REGULATIONS SYSTEM, DEPARTMENT OF DEFENSE","SUBCHAPTER A—GENERAL","PART 204—ADMINISTRATIVE AND INFORMATION MATTERS","Subpart 204.73—Safeguarding Covered Defense Information and Cyber Incident Reporting"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-48.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:26:29Z","sha256":"137edd82a53acc1343493c15601aee4963406a6fa7c5212e61508ae3e4ffa832","source_id":"us-cfr","stale":true,"prev":"us/48-cfr-204.7302","next":"us/48-cfr-204.7304"},"notice":"GroundRules: Original legal text. Not legal advice."}