How to request a NIST 800-171 variance under DFARS 7008 and 7012
A contractor that cannot meet a NIST SP 800-171 requirement as written does not get to decide the matter alone. The request goes through the contracting officer, who forwards it for DoD CIO adjudication. Under DFARS 252.204-7008 the request is made before award, when an offeror proposes to vary from a requirement; under DFARS 252.204-7012(b)(2)(ii)(B) and (C) it is made during performance. In both routes, the DoD CIO decides whether the requirement is not applicable or whether an alternative measure is equally effective, and the outcome depends on the specific requirement, the system handling the CUI and the terms of the contract.
The organization owns three decisions: whether to propose a variance at all, the written justification explaining why the requirement does not apply or how the alternative achieves equivalent protection, and the entry the variance receives in the system security plan. An implementation partner can help assemble the technical evidence, such as configuration records, architecture diagrams and test results, but a partner cannot make the request binding or settle its outcome. Confirm with the contracting officer which form and level of detail they expect, and check whether the contract already references an earlier adjudication, since a prior adjudication must be provided when requesting its recognition under a new contract.
Plan for the flow-down before you file. Under DFARS 252.204-7012(m)(2), a subcontractor that asks the contracting officer to vary from a requirement must notify its prime or next higher tier, so a prime's variance can affect every subcontract that depends on the same system. Record the adjudication in the SSP as 32 CFR 170.24 requires, and keep the entry current when the system changes. Ask the contracting officer to confirm in writing how an accepted variance is incorporated into the contract, because the 7008 route incorporates accepted variances into the contract while a 7012 request may leave the terms to the adjudication itself.
Choosing between the 7008 pre-award route and the 7012 request during performance
The two routes run at different points in the contract lifecycle, and the sequence determines whether a variance is settled before award, handled during performance, or carried forward from an earlier adjudication. Each step ends with a written output that belongs in the system security plan.
Identify the requirement that needs a variance
Before choosing a route, the offeror or contractor names the specific NIST SP 800-171 requirement it cannot meet as written, and records whether the gap is a case of the requirement not applying to its system or of an alternative measure achieving equivalent protection. Engineering and compliance staff should own this analysis. The check that closes the step is a short written note tying the requirement number to the system boundary it affects, so the reader can see exactly what is being asked of the DoD CIO.
Decide whether the variance belongs in the offer
If the variance is known when the offeror prepares its proposal, it goes through the pre-award route under DFARS 252.204-7008. If the gap appears after award, or the contractor is relying on a new contract for work already underway, the request is made during performance under DFARS 252.204-7012(b)(2)(ii)(B) and (C). The decision is recorded in the proposal file so the contracting officer can see which route was used and why.
Write the pre-award explanation for the contracting officer
Under DFARS 252.204-7008, the offeror explains in writing to the contracting officer, for DoD CIO consideration, why the requirement does not apply or how an alternative but equally effective measure gives equivalent protection. The DoD CIO adjudicates before award. The output is the written explanation submitted with the offer, and the offeror should keep a copy with the system security plan working files.
Confirm the adjudication and incorporate the variance
If the DoD CIO accepts the variance before award, the accepted variance is incorporated into the contract. The contractor then confirms the contract text reflects the accepted variance, including the requirement number and the approved alternative or not-applicable basis. The output is the incorporated variance in the executed contract, which the contractor records in the SSP as a DoD CIO adjudication.
Submit a request during performance
For a variance that arises after award, the contractor asks the contracting officer under DFARS 252.204-7012(b)(2)(ii)(B) and (C), again for DoD CIO consideration. Subcontractors must notify the prime when they make this request under DFARS 252.204-7012(m)(2). The output is a written request that identifies the requirement, the system, and the basis for not-applicability or equivalent protection, and the contractor should expect the adjudication to be tracked as a contract matter.
Supply a prior adjudication for a new contract
When a new contract relies on a variance the DoD CIO already adjudicated under an earlier contract, the contractor must provide that prior adjudication when asking for its recognition. Ask the contracting officer which earlier decision applies and confirm the requirement, system boundary and facts match. The output is the prior adjudication attached to the request, so the new contract does not depend on an unsupported claim.
Record the adjudication in the system security plan
Under 32 CFR 170.24, any DoD CIO adjudication of an alternative or not-applicable requirement must be included in the SSP. The contractor updates the SSP entry for the affected requirement and cites the adjudication. The check that closes the step is an SSP review confirming the entry, the adjudication reference and the system boundary agree with the contract file.
Confirm the variance in the assessment record
Before an assessment, the contractor confirms that the adjudicated variance appears where the assessor will look for it, and that the methodology's scoring treats accepted variances as implemented. Organizations should ask their assessor and the contracting officer to confirm how a pending or unresolved request is scored, since DeployOpen prepares evidence but does not issue assessment results. The output is an assessment file that matches the contract and the SSP.
What the written justification must explain
A variance request must show one of two things: that the NIST SP 800-171 requirement does not apply to the system in question, or that an alternative but equally effective measure gives equivalent protection to the CUI. The DFARS clauses frame both grounds in the same way, so the justification should state which ground applies and then prove it. A bare statement that a control is "not needed" or "covered elsewhere" will not give the contracting officer enough to forward the request for DoD CIO consideration. Name the specific requirement by its number, such as 03.13.08 for the CUI in transit and at rest requirement, and identify the system or components it applies to.
The justification should describe the system boundary the variance covers, not just the organization. Define which assets, users, networks and cloud or external services sit inside that boundary and which do not. Then explain the risk the requirement addresses in this environment, such as unauthorized disclosure of CUI through a particular interface, and show how the proposed alternative reduces that same risk. Each compensating measure needs supporting evidence, for example configuration exports, architecture diagrams, access records or test results that an assessor could examine. Keep the alternative tied to the stated risk, because adjudicators score equivalence against the risk the requirement was written to address.
Confirm the current form and content expectations with the contracting officer before drafting, since no standard template is supplied for these requests. Ask whether the CO expects a particular format, whether the request must cite a prior DoD CIO adjudication for a new contract, and how the accepted outcome will be recorded in the contract and the System Security Plan. Ask the CO and your assessor how any adjudicated variance should be reflected in the SSP under 32 CFR Part 170, so that the justification and the SSP stay consistent from the start.
Telling the prime when a subcontractor asks for a variance
Under DFARS 252.204-7012(m)(2), a subcontractor that asks the contracting officer to vary from a NIST SP 800-171 requirement has to tell its prime, and it has to pass along the DoD-assigned incident report number once a cyber incident is reported. The four cards below cover who gives notice, what the notice contains, when it goes out, and how the prime uses it in its own flow-down and system security plan.
Who must notify
The duty falls on any subcontractor that asks the contracting officer to vary from a NIST SP 800-171 requirement. The notice goes to the prime contractor or, where the subcontract sits lower in the chain, to the next higher tier subcontractor. A subcontractor that routes its request only to the Government and says nothing upstream has not met the clause, and the prime may be left with a variance it does not know about. Check which tier each subcontract names as the recipient of notices.
What to include
The notice should identify the specific NIST SP 800-171 requirement by number, state whether the subcontractor is asking that it be treated as not applicable or as met by an equally effective alternative, and describe that alternative. It should also say whether a prior DoD CIO adjudication exists and under which contract it was obtained, since a prior adjudication must be provided when requesting its recognition under a new contract. Ask for a copy of the written request sent to the contracting officer so the prime can record it accurately.
When to notify
The clause ties the duty to the request itself, so the prime should hear about the variance at the time the subcontractor submits it to the contracting officer, not after the Government decides. For incidents, the subcontractor must give the prime the DoD-assigned incident report number as soon as practicable after it reports a cyber incident. Agree on a named contact and a short notice window in the subcontract so these events are not lost in general correspondence.
How the prime records the notice
The prime should log each variance request and incident number against the subcontract, then reflect any accepted DoD CIO adjudication in its own system security plan, which must include those adjudications under 32 CFR 170.24. Where the prime relies on the subcontractor's environment, it should also confirm how that adjudication changes the shared control picture. Review these records at each contract modification and before the prime reports its own posture, because a variance that is missing from the SSP can contradict what the prime represents to the Government.
How adjudicated variances are scored in a DoD assessment
When the DoD CIO has adjudicated a variance, the DoD Assessment Methodology treats the requirement according to the result. A requirement adjudicated as not applicable, or met by an equally effective alternative, is scored as implemented. The contractor does not lose points for that requirement, provided the adjudication is on record and matches the system being assessed. The score reflects the adjudicated position, not the contractor's own reading of it.
- Not applicable: the DoD CIO has accepted that the requirement does not apply to the covered system, and the requirement is scored as implemented.
- Equally effective alternative: the DoD CIO has accepted a different measure that achieves equivalent protection, and that measure is scored in place of the original requirement.
- Scope match: the adjudication must cover the same system, boundary and configuration that the assessor reviews. A changed system may need a new request.
- Prior adjudication: a variance accepted under an earlier contract must be provided when it is requested again under a new one.
- Documentation: the adjudication and the matching measure should appear in the system security plan so the assessor can trace the score.
Confirm with the assessor that each adjudication is on file and that its wording matches the current environment before the assessment begins.
A variance the contractor has proposed but the DoD CIO has not adjudicated does not receive the same credit. The scoring methodology credits adjudicated outcomes, so a proposed variance that is still open generally leaves the requirement unscored as implemented until the DoD CIO rules on it. Treat the open request as a gap to be managed rather than as settled credit.
- Pending requests: a request that has not been decided should be assumed to carry no credit until a written adjudication exists.
- Interim measures: the contractor should describe any interim control in the system security plan so the assessor can see what is in place now.
- Score exposure: a deduction for an open requirement can change the SPRS score the contractor reports.
- Timing: requests made close to an assessment may not be adjudicated in time to be credited.
- Verification: ask the assessor directly how an unadjudicated variance will be scored for the assessment in question.
Ask the assessor, in writing, how each open variance will be scored before the assessment and record the answer in the system security plan.
The methodology handles three requirements differently when the company does not permit the capability they cover. It does not deduct points for remote access (3.1.12), wireless access (3.1.16) or mobile device connection (3.1.18) when the company does not allow those capabilities. The rule is about the capability itself, so the policy and the technical enforcement must both show that the capability is absent or blocked.
- Remote access (3.1.12): the company must prohibit remote sessions to covered systems, and the boundary must enforce that prohibition.
- Wireless access (3.1.16): wireless connections to the covered system must be disallowed, and the configuration should show it.
- Mobile devices (3.1.18): connections from mobile devices must be disallowed for the covered system.
- Evidence of absence: configuration exports, firewall rules and access policies that show the capability is blocked are the evidence an assessor will look for.
- Exceptions: if an exception exists for one of these capabilities, the requirement is no longer simply absent and should be scored on its actual controls.
Confirm with your assessor which methodology version applies to the contract. The methodology cited here is version 1.2.1, dated 24 June 2020, so check whether a later version has been issued before relying on this treatment.
Where the adjudication goes in the system security plan
Once the DoD CIO has adjudicated a variance, the result belongs in the system security plan (SSP). Under 32 CFR 170.24, any DoD CIO adjudication of an alternative or not-applicable requirement must be included in the SSP, so the decision does not live only in correspondence with the contracting officer. For the SSP itself, the relevant anchor is requirement 03.15.02 in SP 800-171 Rev. 3, the Planning family requirement that asks the organization to develop, document and maintain a system security plan describing the system boundary, the operating environment, how the requirements are implemented and the relationships with other systems. Each adjudicated variance should be traceable from the requirement it modifies to the system component it affects, the approved alternative or the not-applicable rationale, the adjudication reference, and the date it was accepted. Confirm the current SSP template and any contract-specific expectations with the contracting officer before you finalize the entry.
DFARS 252.204-7012(b)(3) adds a second category. Where the contractor reasonably determines that other security measures are needed for a dynamic environment or special circumstances, such as medical devices, or for individual, isolated or temporary deficiencies, the clause allows those measures to be addressed in the SSP. This matters for variance work because a temporary gap, such as a legacy component awaiting replacement, usually needs a documented compensating measure, an owner and a closure date, not a permanent exception. Record these items separately from adjudicated variances so an assessor can tell which entries rest on DoD CIO acceptance and which rest on the contractor's own determination. Ask your counsel and the prime which of the two categories each entry belongs in before you write it.
The organization owns the SSP content, including the accuracy of every variance entry and the statement of how the system actually operates. An assessor does not write the SSP; the assessor checks whether the SSP matches the configuration, the policies and the evidence. A variance entry that describes a control the system does not really apply, or an alternative measure that is not running, will fail verification even when the DoD CIO accepted the original request. Before any assessment, walk each entry against the live environment, confirm that the adjudication reference and the scope it covers still match the system, and retire entries that no longer apply after a boundary or technology change. Any variance that touches a cloud or external service provider should also be reflected in the customer responsibility matrix referenced by the SSP, as required under 32 CFR 170.16.
Who owns the decision, the evidence and the outcome
A variance request moves through four hands, and each one owns a different piece of it. The organization decides whether to ask and signs the submission, a partner helps build the technical evidence, the contracting officer routes the request, and only the DoD CIO decides the outcome.
The organization decides and signs
The contractor owns the decision to propose a variance, the choice of alternative measure and the written submission. Only the organization can make the representation that a requirement is not applicable or is met by an equally effective alternative, so the signatory should be someone accountable for the system security plan. Before signing, confirm which requirement is in question, which contract or solicitation it applies to, and whether a prior DoD CIO adjudication already covers it.
Partner prepares the technical evidence
An implementation partner such as DeployOpen can prepare the technical description of the alternative, the configuration evidence that backs it and the matching system security plan text. Those materials need to describe the environment accurately enough for DoD to judge equivalence. A partner does not guarantee acceptance, does not issue adjudications and cannot write the organization's representation for it. Ask for the evidence list in writing before work starts.
Contracting officer routes the request
The contracting officer receives the request and forwards it for DoD CIO consideration, so the contractor's submission must be complete enough to stand on its own when it leaves the contracting office. Under DFARS 252.204-7008 the request is made before award, while under DFARS 252.204-7012 it can be made during performance. Confirm with the contracting officer which route applies to your contract and what format they require.
DoD CIO alone adjudicates
Only the DoD CIO adjudicates whether a requirement is not applicable or met by an equally effective alternative. Accepted variances are incorporated into the contract under the pre-award route, and prior adjudications must be provided when recognition is requested under a new contract. No prime, partner, assessor or auditor can issue that decision. Plan for the possibility of a denial and keep the requirement in your system security plan until a written outcome exists.
Questions contractors ask before requesting a variance
Is a variance the same as a plan of action and milestones?
No. A variance asks DoD to accept that a NIST SP 800-171 requirement does not apply, or that an alternative measure gives equivalent protection. A plan of action and milestones (POA&M) records a requirement you have not yet met and the dates you will close it. A variance goes to the contracting officer, who forwards it to the DoD CIO for consideration. Under DFARS 252.204-7012, requirements the DoD CIO adjudicates as not applicable or equally effective need not be implemented. The two records can sit side by side in the system security plan (SSP), but they answer different questions, so confirm with your contracting officer which one fits your gap before you write anything.
Can a variance be requested after award?
Yes, under DFARS 252.204-7012 a contractor may ask the contracting officer, for DoD CIO consideration, to vary from a NIST SP 800-171 requirement during performance. The pre-award route under DFARS 252.204-7008 is different: the offeror explains the variance in writing before award, and the DoD CIO adjudicates it before the contract is signed. If a variance was adjudicated under an earlier contract, you must provide that prior adjudication when asking for its recognition under a new contract. Ask your contracting officer which route applies to your contract and whether any earlier adjudication already covers your system.
How long does DoD adjudication take?
The supplied sources do not state a duration for DoD CIO adjudication, so confirm the expected turnaround with your contracting officer before you plan a bid or a delivery date. The time depends on how complete the request is, how clearly it explains the alternative control or the reason the requirement does not apply, and whether the supporting evidence matches your SSP. A request that cites specific system components, names the affected requirement numbers and includes the measures you already run will be easier to assess than a general statement. Ask the contracting officer for the expected sequence, any interim status and whether work can start while a request is pending.
Can an implementation partner write the variance request?
A partner can help prepare the technical material, but the request must come from the contractor and the organization owns the controls it describes. An implementation partner can document how the system works, map the affected requirements, draft the equally effective alternative and check that the SSP describes it accurately. DeployOpen prepares systems, controls and evidence and does not issue determinations, attestations or certifications. Only the DoD CIO adjudicates a variance, and the contracting officer handles the submission. Your contracting lead should review every statement, because the request will be read against the SSP and any later assessment.
What happens if DoD does not accept the variance?
If the DoD CIO does not adjudicate a requirement as not applicable or equally effective, the requirement still applies and you must implement it, or record the gap in your assessment. The outcome changes what you show in your SSP and how your score is calculated, because the scoring methodology counts requirements the DoD CIO has adjudicated as implemented. Ask the contracting officer for the reasons, whether the request can be revised and resubmitted, and what remediation timeline the contract expects. Plan the fallback in advance: identify which requirements you can implement directly and which need a POA&M while you work through the decision.
Where does an accepted variance go in the system security plan?
Under 32 CFR 170.24, any DoD CIO adjudication of an alternative or not-applicable requirement must be included in the system security plan. Record the adjudication, the requirement affected, the alternative measure or the reason the requirement does not apply, and the date of the decision. Keep the SSP consistent with how the system actually runs, since assessors check the description against the environment. If the system uses a cloud or external service provider, the customer responsibility matrix must also be documented in or referenced by the SSP under 32 CFR 170.16. Your SSP owner and contracting officer should confirm the exact format they expect.
Do I need to tell my prime contractor about a variance request?
Yes, if you are a subcontractor. Under DFARS 252.204-7012(m)(2), a subcontractor must notify the prime, or the next higher tier subcontractor, when it asks the contracting officer to vary from a NIST SP 800-171 requirement. Send the notice as soon as you submit the request so the prime can plan its own covered defense information and assessment position. Confirm with the prime which records it needs, such as the requirement numbers, the alternative measure and the status of the adjudication. Keep the notice factual and consistent with your SSP, since the prime relies on it when it reports its own compliance.
Confirm the current clause text before you file
Before you draft a variance request, pull the text of the clause in the contract you are bidding or performing under. The variance mechanics sit in DFARS 252.204-7008 and DFARS 252.204-7012, and both are published in the eCFR, which you can read at eCFR: DFARS 252.204-7012 and eCFR: DFARS 252.204-7008. Do not rely on a summary, a prime's template or an earlier award to tell you which paragraph applies. Confirm the clause date and paragraph references in the solicitation or contract itself.
The 2026 class deviation changes how contracting officers use 7012. DoW Class Deviation 2026-O0025, Revision 3, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly. Read it alongside the DoW class deviation document and check whether your contract carries the revised text. The deviation sets the baseline your variance request must address, so a request built on Rev. 3 wording may not match the requirement numbering the contracting officer uses.
The proposed FAR overhaul would require contractors handling CUI to comply with SP 800-171 Rev. 3 using organization-defined parameter values published by the DoW CIO. That rule was not final when this page was written, so it does not yet change your obligations. Track it, and have counsel or your contracts team record in writing which version of the requirements your contract references. If the contract is silent on ODP values, ask the contracting officer for them before you assess variances, because a variance cannot be scored cleanly against a parameter nobody has defined.
