DFARS 252.204-7012 requirements explained

What DFARS 252.204-7012 requires of a DoD contractor

DFARS 252.204-7012 requires you to provide adequate security for covered contractor information systems, which the clause ties to NIST SP 800-171, and to rapidly report any cyber incident affecting covered defense information within 72 hours of discovery. If a contract or solicitation now carries the clause, your first job is to work out which of your systems are covered, which obligations apply to each, and who in your organization owns each decision. The obligations are not uniform. Systems operated on behalf of the Government follow the cloud clause 252.239-7010 or other contract terms, while other covered systems follow NIST SP 800-171. An external cloud provider that stores, processes or transmits covered defense information carries its own equivalent-to-FedRAMP-Moderate and incident support duties under the clause.

Your organization owns its controls, its system security plan and its compliance decisions. An implementation partner can prepare systems, configurations, logging and documentation so the evidence exists when someone asks for it. Only an independent assessor or auditor issues an assessment result or report, and DoD does not accept a vendor's statement in place of that. Ask any partner to put in writing which artifacts it will produce and which parts remain your staff's responsibility.

Confirm the version question before you scope work. The DoW Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names NIST SP 800-171 Revision 2 explicitly, and a 13 July 2026 DoW CIO memorandum requires baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A FAR overhaul proposed rule published 23 June 2026 would instead require SP 800-171 Rev. 3 with DoW-published ODP values, but it was not final as of October 2026. Check the solicitation and the current deviation text with your contracting officer, and plan for the version named in your contract. Review the NIST Rev. 3 publication page for the newer requirement structure.

Which obligations apply to which systems

DFARS 252.204-7012 does not impose one duty. It imposes several parallel obligations that trigger on different events and touch different parties, from the systems that store covered defense information to the subcontractors that receive it. The cards below separate each duty so you can see which one applies to which system and who must act.

Adequate security for covered systems

For covered contractor information systems that are not operated for the Government, the clause requires adequate security, which it meets by implementing NIST SP 800-171. The implementation deadline in the clause was 31 December 2017. Confirm that every system in your covered boundary, including endpoints, identity services and backups, is inside the security plan and that your System Security Plan describes how each requirement is met.

Systems operated for the Government

Covered systems operated on behalf of the Government follow a different path. They are governed by the cloud clause at 252.239-7010 or by other requirements in the contract, not by the NIST SP 800-171 route alone. Ask the contracting officer early whether any system you run will be treated as operated for the Government, because that answer determines which rulebook your assessor and your contract team will use.

External cloud providers at FedRAMP Moderate equivalence

An external cloud service provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, and must also support the clause's incident reporting and forensic requirements. The contractor remains responsible for confirming this. Request the provider's evidence of equivalence and write the provider into your System Security Plan and your flow-down decisions.

Cyber incident reporting within 72 hours

After discovering a cyber incident, the contractor must review for evidence of compromise of covered defense information, including affected computers, servers, data and user accounts, and rapidly report within 72 hours of discovery at DIBNet. The clock starts at discovery, not at confirmation. Assign a named owner for the review, and agree in advance who can file the report, since reporting requires a DoD-approved medium assurance certificate.

Malware submission to DC3

When the contractor discovers and isolates malicious software in connection with a reported incident, it must submit that software to the DoD Cyber Crime Center (DC3) as DC3 or the contracting officer directs. It must not send the malware to the contracting officer. Your incident procedure should keep isolated samples intact, record who handled them, and name the submission route before an incident happens.

Media preservation for 90 days

The contractor must preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data for at least 90 days from submitting the incident report. This lets DoD decide whether to request the media. Confirm that your logging, backup and storage tools can hold these artifacts for that period without overwriting them during routine rotation.

Other security measures for special circumstances

The clause requires additional measures when the contractor reasonably determines they are needed for a dynamic environment or special circumstances, such as medical devices, and for individual, isolated or temporary deficiencies. These measures may be documented in the System Security Plan. The contractor decides what qualifies, so record the reasoning and the compensating controls rather than leaving the decision undocumented.

Offer representation under 252.204-7008

By submitting an offer, the offeror represents that it will implement the NIST SP 800-171 requirements in effect when the solicitation is issued, or as the contracting officer authorizes. This representation is made before award, so gaps must be identified and disclosed during bid preparation. Have your compliance lead review the representation against your current implementation status before the offer is signed.

Flow-down to subcontractors

The prime must flow the clause down without alteration, except to identify the parties, and must decide whether information a subcontractor needs keeps its identity as covered defense information, consulting the contracting officer if unsure. Each subcontractor that handles covered defense information takes on the same duties, including incident reporting. Track which subcontracts carry the clause and what each subcontractor is expected to report back.

How the incident reporting duty runs after discovery

The sequence turns a suspected intrusion into a documented, time-bound report to DoD, a preserved evidence set and, where malware was isolated, a submission to DC3. Each step produces a record you can show a contracting officer or assessor.

Detect and confirm a possible cyber incident
The contractor's security team, or the managed service provider running the system, identifies an event that may affect a covered contractor information system or covered defense information. Someone with authority records the time of discovery, the systems involved and the first facts known. That timestamp matters because the 72-hour reporting window runs from discovery, so the record should show when the organization first knew. Output: an incident ticket with a documented discovery time and a named incident lead.
Review systems for evidence of compromise
Paragraph (c) of the clause requires the contractor to review for evidence that covered defense information was compromised. The review covers affected computers, servers, data and user accounts, not only the device that raised the alert. Analysts check logs, authentication records and file access for the affected systems and document what they checked, what they found and what remains uncertain. Output: a written compromise review that states whether covered defense information may have been affected, with its scope and open questions.
Report to DoD within 72 hours
Where the review shows a cyber incident affecting covered defense information or covered systems, the contractor must rapidly report it, which the clause defines as within 72 hours of discovery, at dibnet.dod.mil. The report is submitted by a person with the required DoD medium assurance certificate, so confirm early that the certificate is current. Record the submission time against the discovery time and keep the incident report number DoD issues. Output: a DIBNet report number and a timestamped submission record. Detailed reporting mechanics are covered on the sibling page on 7012 incident reporting.
Isolate and submit malicious software to DC3
If the contractor discovers and isolates malicious software connected with the incident, paragraph (d) requires submitting it to the DoD Cyber Crime Center (DC3) as DC3 or the contracting officer instructs. The software is not sent to the contracting officer. Handle the sample in a contained environment, keep a hash and chain-of-custody note, and follow the submission instructions DC3 gives. Output: a submission confirmation from DC3 and a custody log. Submission details are covered on the sibling page on malware submission and media preservation.
Preserve images, monitoring data and packet captures
Paragraph (e) requires the contractor to preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data for at least 90 days from the date the incident report is submitted. The purpose is to let DoD request the media or decline interest. Store the images and captures under access controls, document hashes and storage locations, and suspend routine deletion for these records. Output: a preservation register listing each image and capture, its location, and the date the 90-day period started.
Respond to DoD requests and close the record
DoD may respond to the report by requesting media or forensic access, or by declining interest. The contractor should route every request through a named owner, confirm what the request covers, and log each exchange with its date. Once DoD has responded or the 90-day period has run, update the incident record with the outcome, lessons learned and any change to the system security plan or plan of action and milestones. Output: a closed incident file that links the discovery time, review, report number, DC3 submission, preservation register and final disposition.

How the offer representation and older contracts differ

When a solicitation includes DFARS 252.204-7008, submitting an offer is itself a representation. By offering, you state that you will implement the NIST SP 800-171 requirements in effect when the solicitation was issued, unless the contracting officer authorizes something different. The representation is made before award, so the version question is settled early and shapes the system security plan and any variance requests you prepare.

Fixed reference date: the reference point is the date the solicitation was issued, not the date you sign the contract or submit your offer.
Authorization is the only alternative: a different revision or requirement applies only if the contracting officer authorizes it. An internal decision to use a newer or older revision does not replace the representation.
A commitment carried into performance: gaps that exist on the offer date remain your obligation after award, so each one needs a closure date or a documented alternative.
Consistency with your score: any Basic Assessment result you post in SPRS should reflect the requirements you represented in the offer.

Before you sign, check the solicitation issue date, every amendment and the clause text the solicitation incorporates, and record the revision you relied on in your files.

Why the SP 800-171 revision in the contract matters now

The revision named in your contract decides which set of requirements you must meet, so confirm it before you plan any work. NIST published SP 800-171 Rev. 3 on 14 May 2024 and withdrew Rev. 2 the same day, yet DoD contractors are still assessed against the 110 Rev. 2 requirements because 32 CFR 170.14(c)(3) makes the CMMC Level 2 requirements identical to Rev. 2. Rev. 3 contains 97 requirements, so the two versions are not interchangeable, and a gap assessment built on one will not automatically answer the other.

The version picture moved again in 2026. DoW Class Deviation 2026-O0025, Revision 3, signed on 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly. It cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A separate FAR overhaul proposed rule, published 23 June 2026, would require contractors handling CUI to comply with Rev. 3 using ODP values published by the DoW CIO. Comments closed on 23 July 2026, and the rule was not final as of October 2026.

Treat the proposed rule as a planning signal, not a requirement. Ask the contracting officer which revision and which organization-defined parameter values apply to your solicitation or contract, and get the answer in writing. Record that answer in your system security plan, and check whether any Rev. 3 ODP values you adopt would conflict with a Rev. 2 baseline you are being assessed against. Keep the evidence you already produce for Rev. 2 and map gaps to Rev. 3 separately, so a change in the final rule does not force you to start over.

Special circumstances, other measures and the system security plan

Paragraph (b)(3) of DFARS 252.204-7012 lets a contractor go beyond NIST SP 800-171 where the standard alone does not protect covered defense information. The clause names two situations. The first is a dynamic environment or special circumstances, where the contractor reasonably determines that additional measures are needed. The clause gives medical devices as its example, since a device that cannot be patched or configured like an office workstation may still hold or touch covered information. The second is individual, isolated or temporary deficiencies, such as one system that falls short of a requirement for a limited period while a fix is scheduled. In both cases the obligation sits with the contractor. No DoD official pre-approves the determination, so the contractor must be able to show who made it, when, on what facts, and what measure was chosen.

The practical work starts with a documented decision record. For each system or environment that raises a question, record the affected covered system, the requirement or condition at issue, the facts that make the determination reasonable, the additional measure (for example, network isolation, added monitoring or compensating access restrictions), the owner, and a review date. Clause (b)(3) allows these measures to be addressed in a system security plan, so the usual home for the record is the SSP, with the decision traceable to the requirement it modifies. Confirm with your contracting officer and with your own counsel how the record should be kept and whether any measure needs to be reflected in your Basic Assessment or SPRS entry, since those questions depend on your contract and your assessment type.

Questions buyers ask about DFARS 252.204-7012

Does DFARS 252.204-7012 apply to my defense contract?

It applies when a contract includes the clause and your systems store, process or transmit covered defense information, which is the information the contract or the Government identifies as needing protection. The clause is not triggered by the contract's dollar value alone. Check the solicitation and contract for the clause text, then ask the contracting officer which information is covered defense information and which systems hold it. Systems operated on behalf of the Government follow the cloud clause 252.239-7010 or other contract requirements, while other covered systems follow NIST SP 800-171. Confirm the current revision of the clause and the compliance date that applies to your award, because DoD has issued recent deviations that change which SP 800-171 revision contracting officers name.

What does it cost to meet DFARS 252.204-7012, and who gets paid?

Cost depends on how much of your environment holds covered defense information, how much of it already meets SP 800-171, and how you choose to implement and evidence the 110 Rev. 2 requirements. The main cost components are internal staff time, technology and licensing, the implementation work done by an outside partner, the independent assessment fees paid to an assessor, and recurring costs for monitoring, patching, reviews and incident readiness. Some costs are one-time, such as scoping and remediation, and others recur, such as log retention and annual reviews. Ask every quote to separate scoping, implementation, documentation, evidence collection and support, and to state which parts are fixed-scope and which are retainers. No price is given here because the figures depend on your environment.

Must my subcontractors comply with DFARS 252.204-7012?

Yes, when the subcontract involves covered defense information. The clause requires the prime to flow it down to subcontractors that will handle that information, and the prime must decide whether the information a subcontractor needs keeps its identity as covered defense information. If it does, the subcontractor must meet the clause's requirements for its own covered systems and report cyber incidents it discovers as the clause requires. Where the prime is unsure, the clause directs it to consult the contracting officer. Subcontractors that never receive covered defense information generally do not carry the obligation, but confirm this in writing with the prime.

What must a prime contractor flow down to subcontractors?

The prime must include the clause in the subcontract without alteration, except to identify the parties. It must also determine whether any information the subcontractor needs for performance is covered defense information, and consult the contracting officer when that is unclear. Beyond the clause text, the prime should ask the subcontractor for evidence of its SP 800-171 status and any Basic Assessment score it has posted, and agree how incidents will be reported back. Keep the flow-down record in the contract file. Confirm with your contracting officer whether any additional clauses, such as FAR provisions on safeguarding contractor information, also apply to the subcontract.

Must a cloud provider that stores covered defense information be FedRAMP Moderate equivalent?

Yes. Under DFARS 252.204-7012, an external cloud service provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, and must also meet the clause's incident reporting and forensic support requirements. This is separate from the cloud clause 252.239-7010, which covers clouds operated for the Government. Ask your provider for documentation showing equivalency and for its incident reporting commitments in writing. Assessors will look for that evidence, and a provider that cannot show it puts your compliance position at risk.

Can we meet DFARS 252.204-7012 with our own staff?

Often yes, if you have people who understand NIST SP 800-171, your system boundary, and the evidence an assessor will request. The clause does not require an outside firm. Your internal team owns the controls, decides how they are implemented, and is responsible for the system security plan, the Basic Assessment score and the incident response program. Where skills or capacity are thin, an implementation partner can prepare systems, configuration baselines, logging, documentation and evidence in your environment. Whichever route you choose, confirm that a named person owns each control and that the team can operate the controls after handover.

What can an outside partner not do for DFARS 252.204-7012 compliance?

An outside partner cannot issue an audit report, attestation, or certificate that your organization meets NIST SP 800-171 or the clause. Those outputs come from independent assessors and the Government's assessment process, and the organization remains responsible for its own controls and for accurate reporting. A partner prepares systems, controls and evidence and can support you through an assessment, but it cannot sign off on your score or stand in for the Government's review. Ask any firm to put in writing which deliverables it will produce and which belong to the assessor or the contracting agency.

Where to read the clause and the current NIST text

Read the clause itself before you act on any summary, including this one. The eCFR text of DFARS 252.204-7012 is the authoritative public version of the clause, and it is the first link to open: DFARS 252.204-7012 on the eCFR. Your own contract, however, controls which version applies to you. Open the solicitation or contract, find the clause number and date in the Section I clause list, and confirm whether the text in your award is the standard clause or a revised one. Contracting officers can issue class deviations that change the NIST revision the clause names, so the date in your contract matters more than the date on any web copy. Ask the contracting officer in writing if the two do not match.

Read the companion clause on the offer representation next. The eCFR text of DFARS 252.204-7008 is where the representation you make by submitting an offer is stated. Pay attention to the phrase tying the representation to the NIST requirements in effect when the solicitation is issued, or as the contracting officer authorizes. Your compliance team should record which solicitation date and which NIST revision that phrase points to, because that record is what you will be measured against if an assessor or the contracting officer later asks what you represented.

For the requirement text, go to the current NIST publication rather than a secondary summary. Section 1.1 of NIST SP 800-171 Rev. 3 explains the purpose and applicability of the publication, including who it is meant for, which is the first thing to confirm before you map it to your systems. Then read the 32 CFR Part 170 text of the CMMC Program to see how the assessment regime refers back to NIST SP 800-171. Confirm the revision each source names, because the clause, the CMMC rule and NIST's current publication may not point to the same version at any given time.

How DeployOpen prepares systems and evidence for DFARS 7012

DeployOpen works on the technical side of DFARS 252.204-7012: it plans, builds and documents self-hosted open-source platforms inside your own infrastructure so the security requirements and incident handling steps have working systems and evidence behind them. DeployOpen does not issue assessment results or certifications; the contracting agency and assessors judge compliance.

How we scope

Engagements are fixed-scope, with the systems that store, process or transmit covered defense information named in writing before work starts.
The written scope lists the NIST SP 800-171 requirements, system boundaries and cloud or external providers that the work covers.
Scope also records who owns each control, so your organization keeps accountability for its own compliance decisions.

How we build

We implement and harden the platforms that carry covered defense information, including access, logging, encryption and monitoring settings tied to specific requirements.
We configure incident detection and log retention so that review for evidence of compromise can be carried out within the clause's 72-hour window.
We test the configured controls against the requirement wording and record results, so gaps appear before any external assessment.

How we hand over

We deliver the system security plan draft, configuration baselines, network diagrams and the evidence index mapped to each requirement.
We document the incident response runbook, including how images and packet captures would be preserved for the clause's 90-day period.
We train your named staff to operate, review and update the documentation so the evidence stays accurate after handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover, which helps keep the evidence current as systems change.
Retainer work can cover periodic review of configuration drift, logging health and access reviews against the documented controls.
Before any assessment or contract milestone, confirm with your contracting officer and assessor which NIST SP 800-171 revision applies to your contract.