Adequate security
Implement NIST SP 800-171 on covered contractor information systems that process, store, or transmit Covered Defense Information. This is the part everyone knows about, and it is the largest body of work. The 110 requirements →
DFARS clauses
DFARS 252.204-7012 — what the clause actually obligates you to do.
The clause is usually read as "implement NIST 800-171." It requires more than that: a reporting capability with a hard deadline, evidence preservation, obligations you inherit from your cloud providers, and flow-down to your own subcontractors. Cyberneza works through each obligation and tells you which ones you are currently unable to meet.
Reply within one business day.
The obligations
Four things 7012 requires, not one
Cyber incident reporting
Report a cyber incident affecting covered systems or Covered Defense Information to DoD via DIBNet within 72 hours of discovery. Reporting requires a medium assurance certificate — which takes time to obtain, so an organization that starts the process during an incident has already missed the window.
Media preservation
Preserve and protect images of affected systems and relevant monitoring data for at least 90 days from submission, so DoD can request them. This is a capability question, not a policy one: most environments cannot produce a forensic image on demand.
Flow-down
The clause flows down to subcontractors whose work involves Covered Defense Information. That makes your suppliers' posture part of your own compliance position, and their incidents reportable to you.
7012 does not travel alone
- 252.204-7012 — safeguarding, incident reporting, media preservation, flow-down.
- 252.204-7019 — requires a current NIST 800-171 assessment posted in SPRS to be eligible for award. SPRS support →
- 252.204-7020 — gives DoD the right to conduct higher-level assessments and requires supplier cooperation.
- 252.204-7021 — the CMMC requirement itself. CMMC readiness →
The cloud provider clause people miss
Where you use an external cloud service provider to store, process, or transmit Covered Defense Information, 7012 requires that provider to meet security requirements equivalent to FedRAMP Moderate, and requires you to ensure the incident reporting and media preservation obligations reach through to them.
In practice this is what pushes organizations toward GCC High or a purpose-built enclave — and it is worth deciding deliberately rather than discovering it mid-contract. GCC High & enclave planning →
The requirements
DFARS 7012 requirements, paragraph by paragraph
The clause is short enough to read in one sitting and specific enough that each paragraph is a distinct obligation with its own evidence. This is the whole list, in the clause’s own order, with what each one means for a contractor that has to live with it.
| Paragraph | What it requires | What it means in practice |
|---|---|---|
| (b)(1)–(2) Adequate security | Implement NIST SP 800-171 on every covered contractor information system that processes, stores or transmits Covered Defense Information. | The 110 requirements, scoped to the systems that actually touch CDI. The boundary decision comes first; it determines the size of everything else. The 110 requirements → |
| (b)(2)(ii)(A)–(C) Gaps and alternatives | Notify the DoD CIO within 30 days of award of any 800-171 requirement not implemented; requests to vary a requirement or use an alternative measure go to the DoD CIO in writing. | Gaps are allowed to exist; they are not allowed to be silent. A current, honest SSP and POA&M are what make this paragraph meetable. SSP, POA&M & SPRS → |
| (b)(2)(ii)(D) Cloud providers | An external cloud service provider used for CDI must meet security requirements equivalent to the FedRAMP Moderate baseline and comply with the incident reporting, malware, media preservation and damage assessment paragraphs. | The clause reaches through you to your providers. This is the paragraph that decides between commercial, GCC and GCC High tenants and purpose-built enclaves. GCC High & enclave planning → |
| (c) Cyber incident reporting | On discovery of a cyber incident affecting a covered system, CDI, or the contractor’s ability to provide operationally critical support: review for evidence of compromise, identify affected systems and data, and report to DoD within 72 hours via DIBNet. | Reporting requires a DoD-approved medium assurance certificate. Obtain it now; it cannot be obtained inside the window. |
| (d) Malicious software | Submit any malicious software discovered and isolated in connection with a reported incident to the DoD Cyber Crime Center (DC3). | Your incident process needs a step for capturing and handing over samples rather than deleting them. |
| (e) Media preservation | Preserve and protect images of all known affected information systems and all relevant monitoring and packet-capture data for at least 90 days from the report, to allow DoD to request them. | A capability question, not a policy one: most environments cannot produce a forensic image of an endpoint on demand. Decide in advance how images are taken and where they are kept. |
| (f) Access to additional information | On request, provide DoD access to additional information or equipment needed for forensic analysis. | Expect to hand over systems, not just logs. Know what is on them. |
| (g) Damage assessment | Provide the damage assessment information DoD requests after an incident. | Which CDI was exposed, on which systems, over what period — answerable only if you know where CDI lives before the incident. |
| (m) Flow-down | Include the clause, without alteration, in subcontracts involving CDI or operationally critical support; subcontractors report incidents to the prime as well as to DoD. | Your suppliers’ posture is part of your compliance position, and their incidents must reach you in time to meet your own obligations. |
Three definitions that decide your scope
- Covered Defense Information (CDI) — unclassified controlled technical information or other information requiring safeguarding under law, regulation or government-wide policy, that is either marked and provided to you by DoD or that you collect, develop, receive, transmit, use or store in performance of the contract. In practice: CUI in the defence context.
- Covered contractor information system — an unclassified information system owned or operated by or for the contractor that processes, stores or transmits CDI. This is the system the 110 requirements apply to, and the reason the boundary decision comes first. CUI boundary definition →
- Operationally critical support — supplies or services designated by the government as critical for airlift, sealift, intermodal transportation or logistical support essential to mobilization, deployment or sustainment. If your contract carries the designation, incident reporting applies even without CDI.
How 7012 connects to SPRS and CMMC
7012 has required NIST SP 800-171 since the end of 2017 and, for most of its life, relied on contractor self-attestation. The 2020 interim rule added 252.204-7019, which makes a current 800-171 self-assessment score in SPRS a condition of award, and 252.204-7020, which gives DoD the right to conduct Medium and High assessments of that score.
252.204-7021 adds CMMC: third-party or self verification of the same 110 requirements on a defined cycle, phased into contracts under the 48 CFR rule. 7012 is not replaced by CMMC; it is the clause CMMC verifies. The reporting, preservation and flow-down obligations stay with 7012 regardless of certification status. Where the CMMC phase-in stands →
Where contractors fail
Six ways 7012 compliance falls apart in practice
No boundary
CDI arrives in any mailbox and lands on any share, so the covered system is the whole company and the 110 requirements apply everywhere. Most of the cost of 7012 is a scoping decision nobody made.
An aspirational SSP
The System Security Plan describes the environment the organization intends to run, not the one it runs. A Medium assessment or a C3PAO compares the document to reality.
No certificate, no clock
The medium assurance certificate is not in hand, so the first incident is spent on an enrollment process while the 72 hours run out.
Commercial cloud by default
CDI sits in a commercial tenant whose FedRAMP Moderate equivalency was never established, which puts the cloud paragraph — and therefore the whole clause — out of reach.
Nothing to preserve
Endpoints are reimaged on incident, logs roll over in days, and the 90-day preservation obligation cannot be met because the evidence is already gone.
Flow-down on paper only
The clause is in the subcontract, but there is no path for a supplier’s incident to reach the prime inside the prime’s own 72-hour window.
What we do
DFARS compliance support
Read the clauses in your actual contract, establish what each one obligates you to do, and close the gaps between that and what your organization can do today.
Clause review
Work through the DFARS clauses in your contract and identify which obligations attach to you, and where CDI actually flows.
800-171 implementation
The safeguarding half of the clause, scoped to the covered systems rather than the whole company.
Incident reporting readiness
Build the capability to detect, decide, and report inside 72 hours — including obtaining the medium assurance certificate before you need it.
Media preservation capability
Establish how images and monitoring data are captured and retained so a DoD request can actually be answered.
Cloud provider assessment
Determine whether your providers meet the FedRAMP Moderate equivalency requirement, and what to do when they do not.
Subcontractor flow-down
Get the clause into your subcontracts and establish how supplier incidents reach you in time to meet your own deadline.
FAQ
DFARS 7012: common questions
Does DFARS 252.204-7012 apply if we only handle FCI?
Usually not. 7012 attaches when a contract involves Covered Defense Information — CUI in the defence context. If you only receive Federal Contract Information, the governing clause is FAR 52.204-21 with its 15 basic safeguards, and the matching CMMC level is Level 1. The clause list in your contract is the authority; the type of information you actually receive is what the clauses are keyed to, so read both.
Is 7012 compliance the same as a 110 score in SPRS?
No. A 110 score means every NIST SP 800-171 requirement is implemented, which satisfies the adequate-security paragraph of 7012. The clause also requires a working 72-hour incident-reporting capability, media preservation for 90 days, cooperation with damage assessments, FedRAMP Moderate equivalency for cloud providers handling CDI, and flow-down to subcontractors. An organization can hold a perfect SPRS score and still be unable to meet the clause the day an incident happens.
What counts as a cyber incident under 7012?
The clause defines a cyber incident as actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing in it. The practical consequence is that the reporting duty is triggered by potential effect on covered systems or CDI, not only by confirmed data loss — and the 72-hour clock starts at discovery, not at the end of the investigation.
Do we need a DoD-approved medium assurance certificate now, before any incident?
Yes. Reporting goes through DIBNet, and submitting a report there requires a medium assurance certificate issued by an approved External Certification Authority. Obtaining one takes time — identity verification and issuance are measured in days to weeks, not hours — so an organization that starts the process on the day of an incident has already missed the 72-hour window. Getting the certificate before you need it is one of the cheapest 7012 obligations to meet.
Can we use commercial Microsoft 365 or Google Workspace to handle CDI?
The clause requires an external cloud service provider that stores, processes or transmits CDI to meet security requirements equivalent to the FedRAMP Moderate baseline, and to support the incident reporting, media preservation and damage assessment obligations. Whether a given commercial tenant meets that bar is a question of the provider's documented equivalency and the configuration you run, not of the brand name. This is the decision that pushes many contractors toward GCC High or a purpose-built enclave; it is worth deciding deliberately, with the contract in hand, rather than discovering the answer mid-award.
What if we cannot implement every 800-171 requirement before the contract starts?
The clause requires the requirements to be implemented, and it provides a mechanism for gaps: a Plan of Action and Milestones in the System Security Plan, a self-assessment score posted in SPRS that reflects the gaps, and — for a requirement you believe does not apply or that you meet another way — a written request to the DoD CIO. Under 7019 a current SPRS score is a condition of award, and under CMMC Level 2 the room for an open POA&M is narrow and time-limited. The honest path is to score accurately, close the high-weight items first and document the rest.
New to Department of Defense work
This page is step 2 of five on the path from SAM.gov to CMMC.
- Step 1 — Register in SAM.gov.
- Step 2 — Read the clauses: FCI, CUI, FAR 52.204-21, DFARS 7012. You are here.
- Step 3 — Get your result on record in SPRS (a Level 1 self-assessment for FCI-only work; a NIST SP 800-171 score where CUI is involved).
- Step 4 — Meet CMMC Level 1 or Level 2.
- Step 5 — Keep it current: renewals, affirmations, day-to-day security.
Start with your contract
Send us the clauses. We will tell you which obligations attach, where Covered Defense Information actually flows, and which requirements you cannot currently meet.
- Cyber AB Registered Practitioner · CPN 76768
- SBA-Certified Veteran-Owned Small Business (VOSB)
- UEI: T97XZHE7C5D5 · CAGE: 1AVJ5
- Standard: NIST SP 800-171 →
- Scoring: SSP, POA&M & SPRS →
- Certification: CMMC readiness →