Government & Defense · Defense Federal Acquisition Regulation Supplement (252.204-7012)
Issued by
US Department of Defense
Typical timeline
3-9 months
Assessed by
Self-assessment / DoD (DIBCAC)
Validity
Ongoing contract obligation
Overview
Who needs DFARS?
- 01Defense contractors whose contracts include DFARS 252.204-7012
- 02Subcontractors that receive covered defense information from a prime
- 03Cloud providers that store or process covered defense information for a contractor
Requirements
What the auditor looks for.
- 01Adequate securityCovered defense information on your systems protected by the security requirements of NIST SP 800-171.
- 02Incident reportingCyber incidents affecting covered defense information reported to the DoD within 72 hours of discovery, through the DIBNet portal.
- 03Evidence preservationImages of affected systems and relevant monitoring data kept for at least 90 days, and made available to the DoD for forensic analysis.
- 04Malicious softwareMalicious software found during an incident submitted to the DoD Cyber Crime Center (DC3).
- 05Cloud servicesCloud services that hold covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline.
- 06Flow-down & SPRSThe clause passed on to subcontractors handling covered defense information, and a current NIST SP 800-171 assessment score posted in SPRS (252.204-7019 and 7020).
Our approach
From scoping to auditor sign-off.
FAQ
Questions, answered.
DFARS 252.204-7012 sets the duty to protect covered defense information and report incidents. CMMC, added to contracts through clause 252.204-7021, verifies that the NIST SP 800-171 controls are actually in place. Most defense contractors need both, so we prepare one control set for them.
The result of a NIST SP 800-171 assessment, out of a maximum of 110, that clauses 252.204-7019 and 7020 require you to post in the Supplier Performance Risk System. We prepare the self-assessment with you and close the gaps before you submit it.
If they store or process covered defense information, they must meet security requirements equivalent to the FedRAMP Moderate baseline. A FedRAMP Moderate authorization is the simplest way to show that; otherwise the provider needs equivalent evidence.
Typical timeline: 3-9 months, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. DFARS shares substantial control overlap with CMMC and CUI, so we build one control set and map evidence across all of them.
Next framework
NIST 800-53
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.