CYBERNEZA™ logo Start a conversation
DFARS clauses

DFARS 252.204-7012 — what the clause actually obligates you to do.

The clause is usually read as "implement NIST 800-171." It requires more than that: a reporting capability with a hard deadline, evidence preservation, obligations you inherit from your cloud providers, and flow-down to your own subcontractors. Cyberneza works through each obligation and tells you which ones you are currently unable to meet.

Start a conversation See the 800-171 requirements

Personal reply within one business day.

The obligations

Four things 7012 requires, not one

Adequate security

Implement NIST SP 800-171 on covered contractor information systems that process, store, or transmit Covered Defense Information. This is the part everyone knows about, and it is the largest body of work. The 110 requirements →

Cyber incident reporting

Report a cyber incident affecting covered systems or Covered Defense Information to DoD via DIBNet within 72 hours of discovery. Reporting requires a medium assurance certificate — which takes time to obtain, so an organization that starts the process during an incident has already missed the window.

Media preservation

Preserve and protect images of affected systems and relevant monitoring data for at least 90 days from submission, so DoD can request them. This is a capability question, not a policy one: most environments cannot produce a forensic image on demand.

Flow-down

The clause flows down to subcontractors whose work involves Covered Defense Information. That makes your suppliers' posture part of your own compliance position, and their incidents reportable to you.

7012 does not travel alone

  • 252.204-7012 — safeguarding, incident reporting, media preservation, flow-down.
  • 252.204-7019 — requires a current NIST 800-171 assessment posted in SPRS to be eligible for award. SPRS support →
  • 252.204-7020 — gives DoD the right to conduct higher-level assessments and requires supplier cooperation.
  • 252.204-7021 — the CMMC requirement itself. CMMC readiness →

The cloud provider clause people miss

Where you use an external cloud service provider to store, process, or transmit Covered Defense Information, 7012 requires that provider to meet security requirements equivalent to FedRAMP Moderate, and requires you to ensure the incident reporting and media preservation obligations reach through to them.

In practice this is what pushes organizations toward GCC High or a purpose-built enclave — and it is worth deciding deliberately rather than discovering it mid-contract. GCC High & enclave planning →

What we do

DFARS compliance support

Read the clauses in your actual contract, establish what each one obligates you to do, and close the gaps between that and what your organization can do today.

Clause review

Work through the DFARS clauses in your contract and identify which obligations attach to you, and where CDI actually flows.

800-171 implementation

The safeguarding half of the clause, scoped to the covered systems rather than the whole company.

Incident reporting readiness

Build the capability to detect, decide, and report inside 72 hours — including obtaining the medium assurance certificate before you need it.

Media preservation capability

Establish how images and monitoring data are captured and retained so a DoD request can actually be answered.

Cloud provider assessment

Determine whether your providers meet the FedRAMP Moderate equivalency requirement, and what to do when they do not.

Subcontractor flow-down

Get the clause into your subcontracts and establish how supplier incidents reach you in time to meet your own deadline.

Start with your contract

Send us the clauses. We will tell you which obligations attach, where Covered Defense Information actually flows, and which requirements you cannot currently meet.

Start a conversation