DFARS 252.204-7012: Safeguarding Covered Defense Information & Cyber Incident Reporting (CMMC / NIST 800-171)
Official federal procurement regulation analysis, contractor performance obligations, and risk mitigation strategies for small businesses.
What It Means in Plain English
Requires all Department of Defense contractors and subcontractors handling Covered Defense Information (CDI) or Controlled Unclassified Information (CUI) to provide 'adequate security' by implementing the 110 security controls of NIST SP 800-171, record a score in SPRS, and report cyber incidents within 72 hours.
Mandatory in all DoD solicitations, contracts, and subcontracts for services, IT, hardware, and engineering where Covered Defense Information is processed, stored, or transmitted.
Mandatory Statutory Requirements
- Implement NIST SP 800-171: Must implement all 110 cybersecurity controls across 14 security domains on contractor information systems.
- SPRS Assessment Score: Must have a current (within 3 years) basic self-assessment score posted in the Supplier Performance Risk System (SPRS) to be eligible for DoD contract award.
- 72-Hour Rapid Incident Reporting: Mandatory reporting of any cyber incident affecting covered defense systems to the DoD Cyber Crime Center (DC3) within 72 hours via https://dibnet.dod.mil.
- Flowdown Requirement: Must include this exact clause in all subcontracts involving covered defense information or operationally critical support.
Contractor Compliance Obligations
- Maintain an up-to-date System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
- Obtain an authorized DoD Medium Assurance Certificate for submitting rapid incident reports to DIBNet.
- Preserve and protect forensic images of affected systems and packet captures for at least 90 days following any reported breach.
Submitting an inflated or falsified NIST SP 800-171 score in SPRS to win a DoD award is aggressively prosecuted under the Department of Justice Civil Cyber-Fraud Initiative with treble damages under the False Claims Act.
Frequently Asked Questions About DFARS 252.204-7012
What is the difference between DFARS 252.204-7012 and CMMC?
DFARS 252.204-7012 is the contractual regulation that mandates the 110 controls of NIST SP 800-171 and incident reporting. The Cybersecurity Maturity Model Certification (CMMC) program provides the formal third-party assessment and verification mechanism to prove compliance with those controls.
Do subcontractors need to comply with DFARS 252.204-7012?
Yes. DFARS 252.204-7012 has a mandatory flowdown clause requiring primes to insert the provision in all subcontracts that process, store, or transmit Covered Defense Information.