DFARS Cybersecurity Requirements: A Clause-by-Clause Guide

DFARS cybersecurity requirements come from a short set of clauses, and the clauses in your contract determine what you owe. Start with 252.204-7012, the safeguarding and incident reporting clause. Then check for the assessment clauses that rely on it, plus CMMC and SPRS language.

For background on DFARS itself, see What Is DFARS?. For the current CMMC policy, see our Revision 3 deviation review.

Where do the DFARS cybersecurity clauses live now?

The Revolutionary FAR Overhaul is rewriting the DFARS through class deviations, part by part. Two matter here.

The Part 204 deviation, 2026-O0043, took effect February 17, 2026. It marks subpart 204.73 (safeguarding covered defense information) and subpart 204.75 (CMMC) as reserved. It keeps subpart 204.76, the Supplier Performance Risk System (SPRS).

The Part 240 deviation, 2026-O0025 Revision 3, now holds that policy. It was signed September 3, 2026. Section 240.370 covers safeguarding and incident reporting, and section 240.371 covers CMMC.

The clause numbers mostly stay the same. Contracting officers still insert 252.204-7008, 7009, 7012, 7021, and 7025. The change is in the assessment clauses: section 240.370-5(d) prescribes a new clause, 252.240-7997, NIST SP 800-171 DoD Assessment Requirements. The section does not prescribe 252.204-7019 or 7020; see the prescriptions on memo pages 15 and 16.

The codified text is still published. Acquisition.gov and the eCFR still show the pre-deviation versions. The deviation tells contracting officers to use Part 240 in their place. Contracts awarded earlier generally keep the clause versions they contain until a modification changes them.

Reader step: for each contract, list every clause number with its date. That includes “MAY 2024” or “JUN 2026 (DEVIATION 2026-O0025)”. Review against that list, not against what the current regulation says.

What does DFARS 252.204-7012 require?

What triggers it

Section 240.370-5(c) prescribes 7012 for solicitations and contracts, including commercial acquisitions under FAR Part 12. It excludes acquisitions solely for commercially available off-the-shelf (COTS) items. In practice, the clause matters once covered defense information sits on a contractor system. The clause calls that system a “covered contractor information system.”

Covered defense information includes controlled technical information and other CUI Registry categories. It counts if DoD marks it and provides it, or if you develop or receive it in support of the contract. Include engineering files and data your team creates for the contract. See our CUI guide.

Safeguarding

Paragraph (b)(2) applies NIST SP 800-171 to covered systems that are not operated on behalf of the Government. The deviation version names Revision 2 explicitly. The codified MAY 2024 version refers to the revision “in effect at the time the solicitation is issued or as authorized by the Contracting Officer.”

To vary from a requirement, you submit a written request to the contracting officer, and the DoD CIO adjudicates it. Keep a copy of any approval: the clause requires you to give it to the contracting officer when you ask for recognition under a new contract.

External cloud providers

Paragraph (b)(2)(ii)(D) applies if a cloud provider stores, processes, or transmits covered defense information for you. You must require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also comply with paragraphs (c) through (g): incident reporting, malicious software, media preservation, forensic access, and damage assessment. See the deviation clause text, memo page 42.

The clause asks for both. Check the provider’s security baseline and its contract terms for reporting and media preservation. Our FedRAMP comparison covers the baseline question in more depth.

Reporting, malicious software, and media

Paragraph (c) defines “rapidly report” as within 72 hours of discovery. You report through DIBNet, and you need a DoD-approved medium assurance certificate to do it. Paragraph (d) sends isolated malicious software to the DoD Cyber Crime Center (DC3), not to the contracting officer. Paragraph (e) requires you to preserve images of affected systems and relevant monitoring and packet capture data. Keep them for at least 90 days from submission of the report.

Section 240.370-3(d) states that a reported incident does not, by itself, prove that you failed to provide adequate security. Our 72-hour reporting guide covers how to prepare for the report.

Flowdown

Paragraph (m) requires you to include the clause, without alteration except to identify the parties, in subcontracts that involve covered defense information or operationally critical support. You decide whether the information a subcontractor needs keeps its identity as covered defense information. If that is unclear, consult the contracting officer. Subcontractors must give you their DoD incident report number. They must also tell you when they ask the contracting officer to vary from a NIST requirement.

Evidence to keep

• A system security plan for each covered system, plus a plan of action for open requirements.
• Variance requests and DoD CIO adjudications.
• Cloud provider agreements that address paragraphs (c) through (g), plus the provider’s FedRAMP authorization or equivalency evidence.
• Status of the medium assurance certificate and the incident response procedure.
• Incident reports, report numbers, and preserved images, kept for the 90-day window.
• The list of subcontracts that received the clause, and your rationale for each covered defense information decision.

What changed for 252.204-7019 and 7020?

Under the codified rule, provision 252.204-7019 (NOV 2023) requires a current NIST SP 800-171 DoD Assessment for award. “Current” means not more than 3 years old unless the solicitation sets a shorter period. Offerors without one may submit a Basic Assessment for posting to SPRS. They score it with the DoD Assessment Methodology.

Clause 252.204-7020 requires access for Medium and High government assessments. It also bars award of a subcontract subject to 7012’s NIST requirements unless the subcontractor has completed at least a Basic Assessment within the last 3 years.

The deviation’s replacement clause, 252.240-7997 (FEB 2026), takes a narrower approach. It applies to covered systems that must comply with NIST SP 800-171 under 7012. It requires access to your facilities, systems, and personnel for a Medium or High assessment, scored under 32 CFR 170.24. It allows 14 business days after an assessment to rebut findings. Its subcontract paragraph flows the clause’s substance to all subcontracts except COTS.

The 7997 text does not include the Basic Assessment submission path or the subcontractor pre-award check found in 7019 and 7020. This guide does not conclude what that means for any particular award. Ask the contracting officer which assessment terms apply, and get the answer in writing.

Evidence to keep: your current score and how you calculated it, the SPRS posting record, the SSP version the score reflects, and any assessment results or rebuttals.

How does 252.204-7021 apply while Phase 2 is suspended?

Clause 7021 requires a current CMMC status at the level the contracting officer fills in. That status must cover every system that processes, stores, or transmits FCI or CUI during performance. The clause also requires an annual affirmation in SPRS by your affirming official, and you must submit your CMMC unique identifiers (UIDs). See the clause text, memo page 54.

You flow it down when a subcontract involves FCI or CUI, following 32 CFR 170.23. Under that section, an FCI-only subcontractor needs Level 1 (Self). A subcontractor handling CUI needs at least Level 2 (Self). It needs Level 2 (C3PAO) when the prime requires Level 2 (C3PAO) or Level 3.

The policy context has changed. Revision 3 suspends the November 2026 Phase 2 transition. Requiring activities may include Level 1 (Self) or Level 2 (Self) assessments. Contracting officers must remove or revise affected CMMC requirements through solicitation amendments or contract modifications. Baseline NIST SP 800-171 Rev. 2 compliance under 7012 stays in place. Section 240.371-5 keeps the clause dependent on a program office determination until November 9, 2028. Our Phase II suspension article covers the July announcement.

Evidence to keep: self-assessment results entered in SPRS, CMMC UIDs for each system, affirmation dates and the affirming official, any amendment or modification that revised the requirement, and the level you flowed to each subcontractor.

Is 252.204-7024 still current?

Yes. The Part 204 deviation keeps subpart 204.76. It prescribes 252.204-7024 in solicitations for supplies and services, unless DoDI 5000.79 exempts them. See Part 204 memo page 16.

This provision covers SPRS risk assessments, not NIST scores. The contracting officer considers item risk, price risk, and supplier risk, including quality and delivery. The provision does not ask you to submit anything. You can view your own risk assessments in SPRS, and the SPRS user’s guide explains how to challenge a rating. It is not a flowdown clause.

Evidence to keep: a periodic review of your SPRS risk assessments, plus records of any challenge you file.

Summary table

This table is a reading aid, not legal advice. Confirm interpretations with counsel or the contracting officer.

Where does the workflow gap show up?

A clause review leads to one practical question: can your team show where covered defense information lives? Check whether mail, shared folders, and chat hold copies the SSP does not describe. Check whether each cloud agreement addresses reporting and media preservation.

If that is your gap, request a defense pilot scoped to one CUI workflow with IRONKEEP. IRONKEEP brings mail, files, docs, chat, and meetings under shared identity, audit, retention, legal hold, and evidence export. The workspace is in private beta, and your organization still owns its CUI scope, policies, and assessment. IRONKEEP is pursuing FedRAMP authorization but is not currently authorized. Review that status against your 7012 cloud obligations before introducing covered defense information.

Run the review on one contract this week

Pick your most active DoD contract or subcontract. Have the contracts lead list each cybersecurity clause and its date. Have the security lead match each clause to the evidence above. Mark every item without an owner and assign a follow-up date.

If the review raises questions about how your statements to the government match your environment, read the Honeywell settlement review next. Keep the clause list with your SSP so the next reviewer can follow both.