Short answer: DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” is the contract clause that makes defense contractors protect Controlled Unclassified Information (CUI). It requires you to implement the 110 security requirements of NIST SP 800-171 Rev. 2, report cyber incidents to DoD within 72 hours, preserve evidence, use cloud services that meet FedRAMP Moderate-equivalent security, and flow the clause down to subcontractors that handle CUI. It is in nearly every DoD contract except those solely for commercially available off-the-shelf (COTS) items, and it was not affected by the CMMC Phase II suspension.
Who does DFARS 7012 apply to?
DoD instructs contracting officers to include the clause in all solicitations and contracts, including those for commercial products and services, except those solely for COTS items. It applies to any covered contractor information system: a contractor-owned or contractor-operated system that processes, stores, or transmits covered defense information.
Covered defense information is unclassified controlled technical information or other information listed in the CUI Registry that requires safeguarding, and that is either marked or identified in the contract and provided by DoD, or collected, developed, received, used, or stored by the contractor to perform the contract. In practice, it means CUI. See What Is CUI? for how to recognize it.
If you have the clause but genuinely never handle CUI, its security requirements have little to apply to. That’s rare once drawings, specifications, or technical data change hands, so confirm it rather than assume it.
What does DFARS 7012 require?
| Paragraph | Requirement | What it means for you |
|---|---|---|
| (b) Adequate security | Implement NIST SP 800-171 on covered systems | All 110 requirements, documented in a System Security Plan |
| (b) Cloud services | External cloud providers must meet FedRAMP Moderate-equivalent security and the clause’s incident requirements | Not every commercial cloud plan qualifies for CUI |
| (c) Incident reporting | Report cyber incidents to DoD at dibnet.dod.mil within 72 hours of discovery | You need an incident process and a DoD-approved medium assurance certificate |
| (d) Malicious software | Submit isolated malware to the DoD Cyber Crime Center (DC3) | Not to your contracting officer |
| (e) Media preservation | Keep images of affected systems and relevant monitoring/packet capture data for at least 90 days after reporting | Your logging and backup approach must make this possible |
| (f)–(g) Forensics | Give DoD access to information or equipment needed for forensic analysis and damage assessment, on request | Plan for it in incident response |
| (m) Subcontracts | Flow the clause down, unaltered, to subcontractors handling covered defense information | Primes must push it down; subs report incidents to DoD and pass the report number up |
Which version of NIST SP 800-171 applies?
Revision 2. NIST published Revision 3 in May 2024, but DoD has kept contractors on Rev. 2. The DFARS class deviation now in use (2026-O0025, Revision 3) writes “Revision 2” directly into the clause text, and the July 13, 2026 DoD CIO memo that suspended CMMC Phase II also requires baseline compliance with NIST SP 800-171 Rev. 2 under DFARS 252.204-7012. Rev. 2 has 110 requirements across 14 families.
You may request to vary from a specific requirement in writing to your contracting officer, for DoD CIO consideration. Approved variances are written into the contract. Don’t assume a requirement doesn’t apply without that approval.
How does 72-hour incident reporting work?
“Rapidly report” means within 72 hours of discovering a cyber incident that affects a covered system, the covered defense information on it, or your ability to provide operationally critical support. In practice:
- Get the certificate now. Reporting through DIBNet requires a DoD-approved medium assurance certificate. Getting one takes time, so don’t wait for an incident.
- Investigate and report. Review the affected systems, identify what covered defense information was involved, and submit the report with the required fields.
- Preserve evidence. Keep images and relevant monitoring or packet capture data for at least 90 days from the report.
- Send malware to DC3, if you isolated any.
- If you’re a subcontractor, report to DoD and give the incident report number to your prime (or next higher-tier sub) as soon as practicable.
Reporting an incident is not, by itself, treated as evidence that you failed to provide adequate security.
How does DFARS 7012 relate to CMMC and SPRS?
- DFARS 7012 sets the obligation: protect CUI with NIST SP 800-171 and report incidents.
- CMMC (DFARS 252.204-7021 and 32 CFR Part 170) verifies it, through self-assessments or third-party assessments, depending on the contract. The CMMC Phase II suspension paused mandatory third-party certification, not DFARS 7012.
- SPRS is where assessment results and CMMC status are recorded. See What Is an SPRS Score?
Older contracts may also contain DFARS 252.204-7019 and 252.204-7020, which required a NIST SP 800-171 self-assessment score in SPRS. In new solicitations under DoD’s FAR overhaul class deviations, effective February 1, 2026, 7019 no longer appears and 7020 has been replaced by DFARS 252.240-7997, which covers government-led Medium and High assessments. Read the clauses in your own contracts. They govern what you owe.
What are the most common DFARS 7012 gaps for small contractors?
- No System Security Plan, or one that describes intentions rather than how controls actually work. See SSP & POA&M.
- No medium assurance certificate and no tested incident-reporting procedure.
- CUI in non-qualifying cloud services, such as consumer file sharing or standard commercial email plans.
- Logs that don’t support 90-day preservation or forensic review.
- Subcontractors never told they’re handling CUI or what the clause requires.
- Scope that’s too big: securing the whole company when CUI lives on a few systems.
Frequently Asked Questions
Is DFARS 252.204-7012 still in effect after the CMMC Phase II suspension?
Yes. The July 13, 2026 DoD CIO memo suspended the November 2026 move to Phase II, but it expressly requires baseline compliance with NIST SP 800-171 Rev. 2 under DFARS 252.204-7012. See CMMC Phase II Is Suspended.
Does DFARS 7012 require a third-party certification?
No. DFARS 7012 requires you to implement NIST SP 800-171 and meet its reporting rules. Third-party assessment comes from CMMC, and only where a contract requires it. DoD can also conduct its own Medium or High assessments of your implementation.
What’s the deadline for implementing NIST SP 800-171?
The clause required implementation “as soon as practical, but not later than December 31, 2017.” For any contract containing the clause today, the requirement already applies.
Do subcontractors have to comply with DFARS 7012?
Yes, if their work involves covered defense information or operationally critical support. Primes must include the clause, unaltered, in those subcontracts. Subcontractors report incidents directly to DoD and give the incident report number to the next tier up.
How USCIBER can help
USCIBER helps small defense contractors meet DFARS 252.204-7012 in practice: scoping where CUI lives, closing NIST SP 800-171 gaps, writing a System Security Plan and POA&M (Compliance Documentation Project), and putting an incident-reporting process in place. Start with a CMMC Readiness Review (from $7,500) or learn more about our NIST 800-171 & DFARS compliance work.
Sources
- acquisition.gov — DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
- DoD (DPCAP) — Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40 / DFARS Part 240
- DoD CIO — CMMC
- NIST — SP 800-171 Rev. 2
- DoD — DIBNet cyber incident reporting and ECA medium assurance certificates
This article is general information, not legal advice.