DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, requires contractors of the Department of War (DoW, also DoD) that handle covered defense information to implement NIST SP 800-171 Rev 2, report cyber incidents within 72 hours, preserve images and malicious software, and flow the clause down to subcontractors.
What is DFARS 252.204-7012?
DFARS 252.204-7012 is the Defense Federal Acquisition Regulation Supplement clause that sets cybersecurity obligations for contractors whose information systems hold covered defense information. It appears in almost every DoW solicitation and contract, except those solely for commercially available off-the-shelf (COTS) items.
Covered defense information (CDI) is unclassified controlled technical information or other information in the Controlled Unclassified Information (CUI) Registry that DoW provides to you, or that you collect, develop, receive, transmit, use or store in support of a contract. In practice, CDI is DoW’s CUI in your hands.
What does DFARS 7012 require, paragraph by paragraph?
| Paragraph | What it requires | What it means for you |
|---|---|---|
| (b) Adequate security | Implement NIST SP 800-171 Rev 2 on covered contractor information systems | Each requirement implemented, or a variance approved by the DoW CIO |
| (b)(2)(ii)(D) Cloud services | A cloud provider holding CDI must meet FedRAMP Moderate equivalent security | Check every cloud service that stores, processes or transmits CDI |
| (c) Incident reporting | Report cyber incidents within 72 hours of discovery | Hold a DoD medium assurance certificate and name who files |
| (d) Malicious software | Submit isolated malicious software to the DoD Cyber Crime Center (DC3) | Know how to isolate and submit samples |
| (e) Media preservation | Keep images and monitoring data for at least 90 days after the report | Be able to image affected systems quickly |
| (f), (g) Forensics and damage assessment | Together with (e) above: give DoW access for forensic analysis and provide the preserved media on request | Keep preserved media retrievable |
| (m) Flow-down | Include the clause in subcontracts involving CDI or operationally critical support | Subcontractors report to DoW and give you the report number |
1. Adequate security: NIST SP 800-171 Rev 2
Paragraph (b) requires adequate security on every covered contractor information system. For systems you operate for yourself, that means implementing the security requirements of NIST SP 800-171 Revision 2. Where a requirement does not apply or you use an equally effective alternative, you ask the contracting officer, and the DoW CIO adjudicates the request.
2. Cyber incident reporting within 72 hours
Paragraph (c) requires you to rapidly report cyber incidents that affect covered defense information or your ability to perform operationally critical support. Rapidly means within 72 hours of discovery. Reports go through the DIBNet portal (dibnet.dod.mil), and you need a DoD-approved medium assurance certificate to file one, so obtain it before you need it.
3. Malicious software, preservation and forensics
Paragraph (d) sends malicious software you isolate in connection with a reported incident to DC3, not to the contracting officer. Paragraph (e) requires you to preserve images of affected systems, and relevant monitoring and packet capture data, for at least 90 days from the report. Paragraphs (f) and (g) give DoW access for forensic analysis and, if it assesses damage, to the preserved media.
4. Cloud services and flow-down
If an external cloud service provider stores, processes or transmits covered defense information for you, paragraph (b)(2)(ii)(D) requires the provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to follow the clause’s reporting, malware, preservation and forensic rules. Paragraph (m) requires you to flow the clause down to subcontractors whose work involves covered defense information, and those subcontractors report incidents to DoW directly.
How do you prepare for a DFARS 7012 incident?
The 72-hour clock starts at discovery, so the work happens before an incident, not during one.
- Obtain the medium assurance certificate and name who files reports.
- Write and rehearse the incident response procedure, including who decides that an event is reportable.
- Keep centralized logs and know how to image affected systems quickly.
- Make sure subcontractors that handle covered defense information carry the clause and send you the incident report number.
- Record each incident, report and follow-up so the history is available to DoW and to your own reviews.
Where do contractors most often fall short on DFARS 7012?
- No medium assurance certificate when an incident happens.
- Covered defense information in a cloud service without FedRAMP Moderate equivalency.
- A System Security Plan that does not match the systems actually in use.
- Subcontracts that never received the clause.
- Logs not kept long enough to reconstruct what happened.
How do 7008, 7012, 7997, 7021, 7019 and 7020 fit together?
Several clauses work around 7012. Under Class Deviation 2026-O0025 Rev 3, these are the ones that matter:
- 252.204-7008: by submitting an offer, you represent that you will implement NIST SP 800-171.
- 252.204-7012: the safeguarding and incident reporting obligations above.
- 252.240-7997: lets DCMA conduct Medium or High NIST SP 800-171 assessments; its results take precedence over any other assessment.
- 252.204-7021 and 7025: CMMC requirements, now limited to Level 1 (Self) and Level 2 (Self) where a contract includes them.
- 252.204-7019 and 7020: the older self-assessment clauses, replaced by 7997 in the deviation; existing contracts carry them until modified.
What changed with the 2026 class deviation?
DoW (DoD) is removing or revising CMMC requirements in its contracts; NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline. In July 2026 the DoW CIO suspended the planned November 2026 move to CMMC Phase 2, and Class Deviation 2026-O0025 Rev 3, signed September 3, 2026, told contracting officers to remove or revise CMMC requirements in new and existing contracts. It did not touch the substance of 7012: incident reporting still applies, and DCMA can still assess you. CMMC status →
How does a dedicated enclave help you meet DFARS 7012?
Most 7012 obligations become easier when covered defense information lives in one defined boundary. SENTRE, a managed CUI enclave built by ITG, keeps CUI on a server stack you own, in ITG’s secure facility or your own secure room, which keeps the cloud equivalency question out of scope because no external cloud provider holds your CUI.
SENTRE implements the NIST SP 800-171 Rev 2 requirements inside the enclave and delivers the incident response plan, procedures and training. The plan includes the 72-hour reporting step to DoW that paragraph (c) requires. Preserving images and logs is simpler when the affected systems sit inside one enclave with centralized logging.
Frequently asked questions
Who must comply with DFARS 7012?
Any contractor or subcontractor whose contract includes the clause and whose information systems store, process or transmit covered defense information, or who provides operationally critical support. In practice that covers most DoW suppliers that receive technical data, drawings or other CUI to perform the work.
What counts as covered defense information?
Unclassified controlled technical information or other CUI Registry information that DoW provides to you, or that you collect, develop, receive, transmit, use or store in support of the contract. Check how CUI is marked in your contracts and where it flows in your organization.
Does DFARS 7012 allow cloud services?
Yes, if the cloud service provider meets security requirements equivalent to the FedRAMP Moderate baseline and follows the clause’s incident reporting, malware, preservation and forensic requirements. The burden of checking sits with you, so keep the provider’s evidence on file.
What happens if we cannot report within 72 hours?
The clause requires a report within 72 hours of discovery, and a late or missing report is a breach of the clause. Prepare in advance: obtain the medium assurance certificate, assign who files the report, and rehearse the procedure so the decision to report is not made for the first time during an incident.
Is DFARS 7012 the same as CMMC?
No. DFARS 7012 sets the security requirements and the reporting duties; CMMC is the program that verifies them, through self-assessment or third-party assessment. Under the 2026 deviation, CMMC requirements are being removed or revised in contracts, while 7012 stays in place unchanged.
Does DFARS 7012 require an SPRS score?
Not by itself. A score in SPRS comes from CMMC Level 2 (Self) under 7021, a legacy 7019 or 7020 contract, or a DCMA assessment under 7997. Every offer still represents NIST SP 800-171 implementation under 7008, with or without a score. SPRS score guide →
Want to see how a dedicated enclave would meet DFARS 7012 for your contracts? Request a Discovery Session →