DFARS Compliance For Defense Contractors

DFARS Compliance Requirements in Plain Language

The Defense Federal Acquisition Regulation Supplement is the Department of Defense addition to the Federal Acquisition Regulation. Its cybersecurity clauses sit in subpart 252.204, and they travel with the contract. DFARS 204.7304 tells contracting officers to use clause 252.204-7012 in all solicitations and contracts, including those for commercial products and commercial services, except solicitations and contracts solely for commercially available off-the-shelf (COTS) items. The 7019 provision and the 7020 clause carry the same COTS exception. If you sell anything other than pure COTS items to DoD, or to a prime that sells to DoD, assume these clauses apply until your contract review proves otherwise.

The obligations attach to information, not to company size. Clause 7012 protects covered defense information: unclassified controlled technical information or other information described in the CUI Registry that is either marked or identified in the contract and provided by or for DoD, or collected, developed, received, transmitted, used or stored by or for the contractor in support of contract performance. A ten-person machine shop that receives a controlled drawing carries the same 7012 safeguarding duty as a large prime. What scales with size is the effort, the number of systems in scope, and the number of suppliers you must manage.

That is why a DFARS compliance program starts with scoping. Before anyone counts controls, we identify which contracts carry which clauses, where covered defense information enters the business, which systems process, store or transmit it, and which people and suppliers touch it. Every later step, from the System Security Plan to the SPRS score to the CMMC assessment boundary, depends on getting that boundary right. A boundary drawn too wide multiplies the work; a boundary drawn too narrow leaves CUI on systems nobody assessed.

What changed: who checks the work

The safeguarding requirement itself is not new. The current 7012 text still states that contractors were to implement NIST SP 800-171 as soon as practical, but not later than December 31, 2017. What changed is verification. The 7019 and 7020 rules made a scored assessment, posted in the Supplier Performance Risk System (SPRS), a condition of being considered for award. The CMMC program rule (32 CFR Part 170, published at 89 FR 83092 and effective December 16, 2024) and the DFARS CMMC acquisition rule (90 FR 43560, effective November 10, 2025) then added a CMMC status, an annual affirmation by a senior official, and, for many contracts, an independent assessment. Under 32 CFR 170.3(e), Phase 1 of the CMMC rollout began on the effective date of that 48 CFR rule, and later phases add third-party assessment requirements on a one-year cadence. On July 13, 2026, the Department of War suspended the Phase 2 requirements that had been scheduled to begin November 10, 2026 and opened a 60-day CMMC Reform Task Force review. As of October 2026 the task force recommendations have not been published, and Phase 1 self-assessments and DFARS 252.204-7012 remain in force (Crowell & Moring client alert).

DFARS 252.204-7012 in Brief

Clause 7012 is where most DFARS compliance work begins, and it deserves its own deep dive, which we keep on the DFARS 252.204-7012 page. The service-level summary is short. Paragraph (b) requires adequate security on all covered contractor information systems and, for systems not operated on behalf of the Government, applies NIST SP 800-171. Paragraph (b)(2)(ii)(B) lets a contractor ask the contracting officer, for DoD CIO consideration, to vary from a requirement when an alternative but equally effective measure is in place. Paragraph (b)(2)(ii)(D) requires any external cloud service provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, and to support the incident reporting, malware, media preservation, forensic access and damage assessment paragraphs.

Paragraph (c) is the incident clock. When you discover a cyber incident that affects a covered contractor information system or the covered defense information on it, you must review for evidence of compromise and rapidly report to DoD at dibnet.dod.mil. The clause defines "rapidly report" as within 72 hours of discovery. Reporting requires a DoD-approved medium assurance certificate, which is a procurement step many small contractors only discover during their first incident. Paragraph (d) sends isolated malicious software to the DoD Cyber Crime Center (DC3), and paragraph (e) requires you to preserve and protect images of affected systems and relevant monitoring and packet capture data for at least 90 days from the report.

Those incident duties are where operational readiness matters more than paperwork. A plan that names who decides an event is an incident, who files the DIBNet report, who holds the certificate, and how disk images are captured without destroying evidence is the difference between a 72-hour report and a missed deadline. Our team includes a North Carolina licensed Digital Forensic Examiner, so preservation steps are written by someone who has done the forensic work, not copied from a template.

NIST SP 800-171 DoD Assessments and Your SPRS Score

A DFARS compliance assessment is, at its core, a NIST SP 800-171 DoD Assessment performed under the DoD Assessment Methodology that clauses 7019 and 7020 reference. The 7020 clause defines three types:

• Basic Assessment: the contractor's own self-assessment, based on a review of its system security plan and conducted under the DoD Assessment Methodology. Because it is self-generated, the clause assigns it a confidence level of "Low."
• Medium Assessment: conducted by the Government, consisting of a review of the Basic Assessment, a thorough document review, and discussions with the contractor. Confidence level "Medium."
• High Assessment: conducted by Government personnel using NIST SP 800-171A, adding verification, examination and demonstration of the system security plan. Confidence level "High."

For a Basic Assessment, the summary submitted for SPRS posting includes the NIST SP 800-171 version assessed, who performed the assessment, the CAGE codes covered by each system security plan, the assessment date, the summary score (for example, 95 out of 110), and the date by which all requirements are expected to be implemented, which is to say the date a score of 110 is expected. That last date comes from your plan of action, so a score without a credible POA&M behind it is an incomplete submission.

How the score is calculated

Scoring starts at the maximum, 110, and subtracts the weighted value of each requirement that is not met. Under the CMMC Level 2 scoring methodology in 32 CFR 170.24, requirements that could lead to significant exploitation of the network or exfiltration of CUI are worth 5 points, requirements with a specific and confined effect are worth 3 points, and the rest are worth 1 point. Multi-factor authentication and FIPS-validated encryption can be partially credited: MFA implemented only for remote and privileged users costs 3 points instead of 5, and encryption that is not FIPS-validated costs 3 points instead of 5. Because the deductions add up to more than 110, the score can go negative; with every point-valued requirement unmet, the 170.24 values produce -203. The System Security Plan requirement carries no point value for a different reason: without a current SSP, 170.24 says the assessment cannot be completed at all.

Two practical consequences follow. First, a contractor that rounds up partial implementations is not just shading a number; DoD can test the score in a Medium or High Assessment, and CMMC assessors score against the same requirements. Second, the biggest score gains usually come from a short list of 5-point requirements, which is why our remediation plans are ordered by weighted points and by risk rather than by control number. If you want a quick estimate before talking to anyone, our SPRS score calculator walks the 110 requirements with the same weights.

How DFARS Compliance Relates to CMMC Level 2

CMMC does not replace DFARS 7012. It verifies it. DFARS 252.204-7021 points to 32 CFR Part 170 as the framework for assessing a contractor's compliance with applicable information security protections, and 32 CFR 170.14 states that the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 Rev 2. The work you do for DFARS compliance is the same work a Level 2 assessment examines. The differences are in verification, documentation of scope, and the consequences of gaps.

• Level 2 (Self) and Level 2 (C3PAO). The contracting officer inserts the required status in clause 7021. For Level 2 (Self), the contractor performs the assessment under NIST SP 800-171A and uploads results to SPRS. For Level 2 (C3PAO), an authorized or accredited third-party assessment organization performs it and submits results into the CMMC instantiation of eMASS, which transmits them to SPRS. Either way, the assessment must be repeated within three years.
• Annual affirmation. Clause 7021 requires an affirming official, defined in 32 CFR 170.4 as a senior level representative with authority to affirm continuing compliance, to complete and maintain an affirmation of continuous compliance in SPRS every year.
• Limited POA&M use. A Conditional Level 2 status is possible only if the assessment score divided by the total number of Level 2 requirements is at least 0.8 and no POA&M item is worth more than 1 point, with a narrow exception for SC.L2-3.13.11 FIPS-validated encryption. A POA&M closeout assessment must confirm the open items within 180 days of the Conditional status date, or the conditional status expires.
• Where CUI may live. Clause 7021 requires that FCI or CUI be processed, stored or transmitted only on contractor information systems with the required CMMC status or higher. Cloud services used for Level 2 must be FedRAMP Authorized at the Moderate baseline or meet FedRAMP Moderate equivalency, as described in 32 CFR 170.16.

If you handle only Federal Contract Information and no CUI, your target is CMMC Level 1, built on the 15 safeguarding requirements in FAR 52.204-21; see our CMMC Level 1 guide. If a Level 2 self-assessment is in your contract, our CMMC Level 2 self-assessment guide walks the scoring, SPRS entry and affirmation. For an advisor who carries you from scoping through assessment day, see our CMMC consultant services. For how the NIST and DFARS pieces fit together across frameworks, read NIST and DFARS compliance.

Flow-Down: DFARS Compliance for Subcontractors

DFARS compliance does not stop at the prime. Three clauses push it down the supply chain, and each uses a slightly different trigger:

• 252.204-7012(m) requires the clause, without alteration except to identify the parties, in subcontracts for operationally critical support or where subcontract performance will involve covered defense information, including subcontracts for commercial products or services. Subcontractors must notify the next higher tier when they ask to vary from a NIST SP 800-171 requirement and must pass along the DoD incident report number when they report.
• 252.204-7020(g) bars a contractor from awarding a subcontract subject to NIST SP 800-171 unless the subcontractor has completed at least a Basic NIST SP 800-171 DoD Assessment within the last 3 years for the relevant systems.
• 252.204-7021(f) and 32 CFR 170.23 require the prime to flow CMMC requirements to every tier that will process, store or transmit FCI or CUI. A subcontractor that handles only FCI needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self), and at least Level 2 (C3PAO) if the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC).

For primes, that means a supplier verification process: knowing which suppliers receive CUI, checking SPRS evidence before award, and documenting what was flowed down. For subcontractors, it means the questionnaire from your prime is a contract obligation, not a courtesy. Our DFARS flow-down clauses guide lists the clauses that travel and how to read them in a purchase order.