DFARS 252.204-7012Safeguarding Covered Defense Information and Cyber Incident Reporting
Looking for the official text? Read DFARS 252.204-7012 (MAY 2024) at acquisition.gov. It is a contract clause, so it binds the Contractor during performance. Everything below is checked against that text.
Overview
The most important cybersecurity clause in defense contracting. DFARS 252.204-7012 requires contractors to implement all 110 NIST SP 800-171 security controls to protect Covered Defense Information (CDI) and report cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours. This clause is the foundation for CMMC and applies to virtually all DoD contracts involving CUI.
This is a clause, not a provision
Clauses go into contracts and bind the Contractor during performance; provisions go into solicitations and bind the Offeror before award. DFARS 252.204-7012 is prescribed with the words “use the following clause”, so it governs how you perform, not how you bid.
Still in force after the CMMC Phase 2 suspension — July 13, 2026
The Department of War suspended CMMC Phase 2 on July 13, 2026 pending an acquisition-reform review, which paused third-party (C3PAO) certification as a condition of award. It did not amend DFARS 252.204-7012, 252.204-7019 or 252.204-7020 — those were never part of the CMMC rule and bind you today exactly as they did before. What changed, and what still binds.
When Does This Apply?
All DoD contracts where the contractor will process, store, or transmit Covered Defense Information (CDI) or operationally critical support information.
Key Requirements
- 1Implement all 110 NIST SP 800-171 Rev 2 security controls
- 2Report cyber incidents to DC3 within 72 hours of discovery
- 3Preserve and protect forensic evidence for at least 90 days
- 4Provide medium assurance certificates for incident reporting
- 5Include CDI marking and handling procedures
Work out the score this clause asks for
The number in SPRS is not “how many of the 110 requirements did you do”. Under the NIST SP 800-171 DoD Assessment Methodology — the methodology both 252.204-7019 and 252.204-7020 cite by name — 44 requirements are worth 5 points, 14 are worth 3 and 51 are worth 1, with partial credit on 3.5.3 (MFA) and 3.13.11 (FIPS-validated cryptography) and no points at all on 3.12.4, the System Security Plan, which gates whether the assessment can be conducted. The scale runs from +110 to -203.
Free, no signup, and nothing you enter leaves your browser. Built from NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020), Annex A / §5.
Flowdown to Subcontractors
Yes — DFARS 252.204-7012 carries its own subcontract flowdown.
Paragraph (m), Subcontracts: the Contractor shall “Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties.”
Checked against the clause text at acquisition.gov, read 27 July 2026.
Real-World Example
TechDefense Solutions, a 350-employee cybersecurity contractor, discovered in March 2024 that their SharePoint environment containing Navy logistics CDI had been accessed by an unauthorized external party through compromised VPN credentials. The CISO discovered the breach during routine log analysis but delayed reporting for 96 hours while conducting internal forensics. DoD imposed a $2.3M contract cure notice requiring immediate NIST 800-171 remediation across all systems, plus $180K in third-party incident response costs. The 72-hour reporting violation triggered a DCMA compliance review that suspended $12M in pending task orders for six months. TechDefense ultimately spent $890K implementing proper access controls, multi-factor authentication, and continuous monitoring to regain compliance. The lesson: immediate DC3 reporting within 72 hours is non-negotiable—internal forensics can occur parallel to official notification, and delays compound both financial and reputational damage exponentially.
Why This Matters for Your Business
DFARS 252.204-7012 triggers whenever contractors handle Controlled Unclassified Information (CUI) marked as CDI, affecting 90% of defense contractors from primes to Tier 3 subcontractors. Non-compliance risks immediate contract termination under FAR 52.249-2, False Claims Act liability up to $2.3M per violation, and three-year debarment proceedings. This clause directly feeds CMMC 2.0 Level 2 requirements—contractors must demonstrate 252.204-7012 compliance to achieve CMMC certification by October 2025. The 2026 regulatory trend intensifying enforcement is DoD's new automated compliance monitoring through Enterprise Infrastructure Solutions, which will flag NIST 800-171 gaps in real-time and trigger immediate corrective action requests, making reactive compliance strategies obsolete.
Compliance Checklist for DFARS 252.204-7012
- 1ISSO conducts complete NIST SP 800-171 gap analysis and documents findings in formal System Security Plan (SSP) within 90 days of contract award.
- 2Contracts team verifies CDI identification and marking procedures align with DoD Manual 5200.01 Volume 4 and trains all personnel handling marked information.
- 3IT security implements all 110 NIST 800-171 Rev 2 security controls or documents exceptions in Plan of Action and Milestones (POA&M) with risk acceptance.
- 4Legal counsel establishes cyber incident response procedures including DC3 reporting workflow and 72-hour notification timeline through DIBNet portal.
- 5ISSO configures continuous monitoring tools and establishes forensic evidence preservation procedures for minimum 90-day retention requirement.
- 6Contracts administrator ensures SPRS scores reflect current compliance status and updates monthly through SAM.gov portal.
- 7Security team conducts annual NIST 800-171 assessments and maintains medium assurance certificates for incident reporting authentication.
- 8Procurement officer validates subcontractor flowdown requirements include complete 252.204-7012 implementation and reporting obligations.
Estimated Compliance Cost
Initial compliance ranges from $180K-$450K for mid-size contractors, depending on existing cybersecurity maturity and system complexity. Companies with minimal security infrastructure face costs at the high end, while those with existing SOC 2 compliance typically spend $220K-$280K. Annual maintenance costs average $120K-$180K including continuous monitoring tools, annual penetration testing, and dedicated ISSO resources. Non-compliance remediation costs escalate to $650K-$1.2M when including third-party assessments, accelerated implementation timelines, and potential contract cure requirements. Typical compliance timeline spans 12-18 months for full NIST 800-171 implementation, though DoD may grant 6-month interim authority to operate with approved POA&Ms for low-risk deficiencies.
Cross-References & Related Requirements
DFARS 252.204-7012 serves as the cybersecurity foundation that enables compliance with related clauses including 252.204-7021 (CMMC requirements) and 252.204-7019 (SPRS reporting). The 110 NIST SP 800-171 controls directly map to CMMC Level 2 practices, meaning full 252.204-7012 compliance satisfies most CMMC certification requirements. This clause also interconnects with 252.204-7008 (CAGE code updates) for contractor identification and 252.225-7012 (preference for certain domestic sources) when cybersecurity supply chain considerations apply. The incident reporting requirements feed into 252.204-7009 (limitations on contracting) enforcement decisions, where cyber incidents can trigger enhanced due diligence reviews for future contract awards.
How This Clause Affects Your Proposal
DFARS 252.204-7012 appears in Section I of all solicitations involving CUI/CDI and requires specific proposal response addressing current NIST 800-171 compliance status. Include your SPRS assessment date, score, and POA&M summary in technical proposals. Source selection teams evaluate cybersecurity maturity as a responsibility determination factor—scores below 80 typically trigger pre-award security plan reviews. Prepare documentation including current SSP, recent penetration test results, and incident response procedures for potential requests during competitive negotiations. Address subcontractor cybersecurity management in your proposal, demonstrating flowdown compliance verification procedures. Consider cybersecurity staffing costs in your price proposal, as inadequate security resources often lead to post-award compliance challenges requiring expensive remediation efforts.
Frequently Asked Questions
What is DFARS 252.204-7012?
DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) The most important cybersecurity clause in defense contracting. DFARS 252.204-7012 requires contractors to implement all 110 NIST SP 800-171 security controls to protect Covered Defense Information (CDI) and report cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours. This clause is the foundation for CMMC and applies to virtually all DoD contracts involving CUI.
Does DFARS 252.204-7012 flow down to subcontractors?
Yes. DFARS 252.204-7012 carries its own subcontract flowdown. Paragraph (m), Subcontracts: the Contractor shall “Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties.”
When does DFARS 252.204-7012 apply?
All DoD contracts where the contractor will process, store, or transmit Covered Defense Information (CDI) or operationally critical support information.
Free Compliance Tools
SPRS Score Calculator
Your Basic Assessment score on the real DoD weights — 44 requirements at five points, 14 at three, 51 at one, +110 to −203.
🛡CUI Auditor
Audit your tech stack for CUI handling gaps across 80+ enterprise tools.
🗺CUI Flow Mapper
Map how CUI flows through your organization and identify spillage risks.
Is your tech stack DFARS 252.204-7012 compliant?
Run our free CUI Auditor to check if your tools meet this clause's requirements.
Audit Your Tech Stack FreeTurn this gap analysis into a remediation plan
This DFARS 252.204-7012 breakdown is the start, not the answer. Book a 25-minute compliance assessment — you leave with a prioritized roadmap and a fixed-fee implementation quote.
Book a 25-min assessmentRelated: how much CMMC certification costs — DoD’s own priced figures
Discussion
Share your experience implementing this in your organization.
Join the Club to unlock joining discussions
Free membership — access intelligence, save your work, and more.
Create free account