The DFARS clause that puts NIST SP 800-171 into DoD contracts: what it requires, 72-hour incident reporting, malware and media preservation, cloud providers, variances from SP 800-171, flow-down to subcontractors and DoD's voluntary DIB Cybersecurity Program.
Every obligation in DFARS 252.204-7012 in plain terms: adequate security through NIST SP 800-171, cloud provider requirements, 72-hour incident reporting, malware submission, media preservation, special circumstances, the offer representation and flow-down.
How to report a cyber incident under DFARS 252.204-7012: what triggers it, the review for compromise, reporting to DIBNet within 72 hours, the medium assurance certificate, subcontractor report numbers, other reporting duties and the proposed FAR rule for non-DoD contracts.
What happens after a DFARS 7012 incident report: submitting malware to DC3, preserving system images and packet captures for 90 days, giving DoD forensic access and damage assessment data, how DoD protects your information, and how DHS's 180-day rule differs.
When a cloud or email provider that stores CUI must meet FedRAMP Moderate equivalent security under DFARS 7012, how that differs from the 252.239-7010 rule for clouds run for the Government, how assessors verify it, and an enforcement case over a third-party email host.
How to ask DoD to accept that a NIST SP 800-171 requirement does not apply or is met by an equally effective alternative: the 7008 pre-award route, 7012 requests during performance, telling the prime, how adjudications are scored and where they go in the SSP.
How DFARS 252.204-7012 flows down the supply chain: which subcontracts must include it, the prime's decision on what remains covered defense information, what subcontractors report back, the Basic Assessment check before award, and the parallel FAR and disclosure clauses.
DoD's voluntary DIB Cybersecurity Program for contractors with covered systems: who can join, the Framework Agreement, threat information sharing through DC3's DCISE, extra requirements for classified threat data, and the limits on sharing what you receive.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.