DFARS 252.204-7012 Explained: What Defense Contractors Must Do

If your company has a DoD contract, this clause is almost certainly in it, and most contractors don't fully understand what it requires until they're being assessed. Here's a plain-language breakdown of every obligation DFARS 252.204-7012 puts on your organization.

What Is DFARS 252.204-7012?

DFARS 252.204-7012, formally titled Safeguarding Covered Defense Information and Cyber Incident Reporting, is a Defense Federal Acquisition Regulation Supplement (the set of DoD-specific additions to federal procurement law) clause that the Department of Defense includes in contracts where a contractor will process, store, or transmit Covered Defense Information (CDI).

In plain terms: if your contract involves sensitive DoD information, and most do, this clause is your cybersecurity obligation in contractual form. It flows down to subcontractors at every tier when CDI is involved, which means your primes are required to pass it to you, and you're required to pass it to anyone you subcontract work to.

The Six Core Requirements

DFARS 252.204-7012 imposes six specific obligations on covered contractors. Understanding all six is critical, most compliance programs focus only on the first and miss the others until an incident exposes the gap.

1. Implement NIST SP 800-171 Controls

The clause requires contractors to apply the security requirements in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. That's 110 security requirements across 14 practice families, covering everything from access control and audit logging to incident response and system integrity.

You must implement these controls on any system that stores, processes, or transmits CDI. The scope is your CUI boundary, the set of systems, users, and data flows that touch covered information.

2. Flow Down the Clause to Subcontractors

If you subcontract any work that involves CDI, you are required to include DFARS 252.204-7012 in your subcontracts. This is a hard requirement, not optional. Your primes will increasingly audit this as CMMC enforcement tightens.

3. Report Cyber Incidents Within 72 Hours

If you experience a cyber incident on a covered system, you must report it to DoD via DIBNet (dibnet.dod.mil) within 72 hours of discovery. The report must include details about the systems affected, what CDI may have been compromised, and the techniques the attacker used.

This is not a "wait until you're sure" requirement. The clock starts at discovery, not at confirmation, not at the moment your team finishes arguing about whether it "counts" as an incident.

4. Preserve and Protect Forensic Images for 90 Days

Following a reportable cyber incident, you must preserve images of all compromised systems and make them available to DoD upon request for 90 days. This means you need to have a process in place before an incident happens, not after.

5. Submit Malware Samples

If you discover malicious software on a covered system, you must submit a sample to DoD's Cyber Crime Center (DC3) when requested. This supports DoD's broader threat intelligence mission.

6. Provide Media and System Access for Damage Assessment

DoD may request access to your systems and media to conduct or support a damage assessment after a cyber incident. You are required to cooperate. This is a significant obligation that many contractors don't anticipate.

DFARS 7012 vs. CMMC: What's the Difference?

The key takeaway: CMMC Level 2 covers the same 110 practices as DFARS 7012 but replaces the honor-system self-assessment with independent third-party verification. If your contracts are moving to CMMC requirements, your DFARS 7012 implementation is your CMMC foundation, but it will be scrutinized much more closely.

The SPRS Score: What It Is and Why It Matters

The Supplier Performance Risk System (SPRS) is where DoD contracts officers check your cybersecurity posture before awarding contracts. DFARS 252.204-7021 requires contractors to enter a self-assessed NIST 800-171 score into SPRS before being awarded DoD contracts.

The scoring methodology is defined in DoD's Assessment Methodology. A perfect score is 110. Each unimplemented or partially implemented control carries a point deduction ranging from 1 to 5 points. A contractor with no controls implemented would score -203, yes, negative scores are possible.

What You Need to Have Documented

To demonstrate DFARS 252.204-7012 compliance, and to survive a CMMC assessment, you need the following documentation in place:

• System Security Plan (SSP), documents how you implement each of the 110 NIST 800-171 controls NIST 800-171 §3.12.4
• Plan of Action & Milestones (POA&M), tracks any controls not yet fully implemented with remediation timelines NIST 800-171 §3.12.2
• Incident Response Plan, defines your process for detecting, reporting, and recovering from incidents NIST 800-171 §3.6.1
• System boundary documentation, defines which systems, users, and data flows are in scope for CUI
• Cyber incident reporting procedures, your 72-hour reporting process, DIBNet account, and escalation chain
• SPRS score submission record, date submitted, score, and supporting documentation

Common Mistakes Contractors Make

After working through CMMC implementations across multiple environments, the same gaps come up repeatedly:

• Scoping the CUI boundary too narrowly. Contractors often undercount what systems touch CDI, especially shared infrastructure, email systems, and backup storage.
• Treating DFARS as a one-time checkbox. The clause requires ongoing compliance, not a point-in-time assessment. Controls must be maintained, and the SSP must be kept current.
• No 72-hour incident reporting process. Most small contractors don't have a documented procedure or a DIBNet account set up before an incident forces the issue. Finding out you need a DIBNet account during an active breach is an experience nobody should repeat.
• Not flowing down to subcontractors. This is a hard contractual requirement, not a best practice. Primes are being audited on this.
• Inflated SPRS scores. Self-assessing at 110 when dozens of controls aren't implemented is the kind of gap that becomes a False Claims Act case.

Bottom Line

DFARS 252.204-7012 is not a suggestion. It's a contractual obligation with real enforcement teeth, and the transition to CMMC is making the self-attestation era of DIB cybersecurity compliance effectively over for any contractor working on critical programs. The documentation requirements, SSP, incident response plan, POA&M, aren't bureaucratic overhead. They're the proof that your controls actually exist. Without them, you're essentially asking an assessor to take your word for it. They won't.

Start with the SSP. Everything else builds from it.