What Northrop Grumman Requires
- DFARS 7012 and 7020 on every order. Northrop's standard terms apply DFARS 252.204-7012 and 252.204-7020 to every order except COTS only orders. CTM-P-ST-001, Nov 2026
- The CMMC level in your order. DFARS 252.204-7021 flows down, and each order names the CMMC level you need. CTM-P-ST-001
- Baseline controls. Clause 57 requires the 15 FAR 52.204-21 basic controls plus additional controls, whether or not FAR 52.204-21 applies. CTM-P-ST-001 clause 57
- Compliance before award. Northrop's supplier notice says primes may not award purchase orders to noncompliant subcontractors. Northrop CMMC supplier notice, 2025
How Northrop Grumman Checks
- Evidence on request. Answer Northrop's compliance inquiries with documentation or independent evidence that your controls work. Clause 57.D
- Change notices. Tell Northrop before you make a material change to your systems. Clause 57.E
- SPRS. DFARS 7020 requires a current NIST SP 800-171 assessment posted in SPRS. DFARS 252.204-7020
Incidents and Questions
Report an information security incident within 72 hours to your buyer and to Northrop's Cyber Security Operations Center at (877) 615-3535 (clause 57). Supplier cyber questions go to cybersupplychain@ngc.com.