DFARS clauses

DFARS 252.204-7012: Safeguarding Covered Defense Information

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is the clause that makes cybersecurity a contract requirement for DoD contractors. It requires NIST SP 800-171 security on any contractor system that stores, processes or transmits covered defense information, and rapid reporting of cyber incidents to DoD.

Read the clause text itself at acquisition.gov — the summary below follows its paragraph structure.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 19, 2026

Free CMMC Quick Score DFARS compliance guide

(b) Adequate security — NIST SP 800-171

Paragraph (b) requires "adequate security" on all covered contractor information systems — for covered contractor information systems not operated on behalf of the Government, paragraph (b)(2) specifies the security requirements of NIST SP 800-171 Rev. 2. When a cloud service provider stores, processes or transmits covered defense information, paragraph (b)(2)(ii)(D) requires that service to meet the FedRAMP Moderate baseline (or equivalent). See FedRAMP vs CMMC for what that means in practice.

(c) Rapid incident reporting — 72 hours

Paragraph (a) defines "rapidly report" as within 72 hours of discovery of any cyber incident. Under paragraph (c)(1), the report is made to DoD via DIBNet (dibnet.dod.mil). Paragraph (c)(3) requires a DoD-approved medium assurance certificate to report, which takes time to obtain — get one before you need it, not during an incident.

(d) Malicious software

Paragraph (d) requires submitting malicious software discovered in connection with a reported incident to the DoD Cyber Crime Center (DC3), in accordance with instructions provided by DC3 or the contracting officer. Do not send malicious software to the contracting officer.

(e) Media preservation — 90 days

Paragraph (e) requires preserving and protecting images of all known affected information systems and all relevant monitoring or packet capture data for at least 90 days from submission of the cyber incident report, so DoD can assess damage.

(f) Access for forensic analysis

Paragraph (f) requires providing DoD access to additional information or equipment necessary for forensic analysis of the incident.

(m) Flowdown to subcontractors

Paragraph (m) requires flowing the clause down to subcontracts where the subcontractor will handle covered defense information — including the incident-reporting obligation. Paragraph (m)(2) also requires subcontractors to report incidents directly to DoD and give the prime the incident report number. See the subcontractor flowdown auditor.

7012 vs CMMC

7012 is the obligation; CMMC is the verification. 7012 has required NIST SP 800-171 since 2017 — CMMC (under DFARS 252.204-7021) adds the assessment and affirmation that prove you actually implemented it. The comparison is in DFARS 7012 vs 7021, and the current rollout state is on CMMC status.

Frequently asked questions

What is DFARS 252.204-7012?

The DoD contract clause 'Safeguarding Covered Defense Information and Cyber Incident Reporting'. It requires NIST SP 800-171 security on contractor systems handling covered defense information, FedRAMP Moderate (or equivalent) cloud services, and 72-hour cyber incident reporting to DoD via DIBNet.

Does 7012 require CMMC?

Not directly. 7012 requires implementing NIST SP 800-171; CMMC (under DFARS 252.204-7021) is the separate mechanism that verifies implementation through self-assessment or third-party assessment. A contract can carry 7012 without a CMMC requirement.

How fast must incidents be reported?

Within 72 hours of discovery, reported to DoD through DIBNet (dibnet.dod.mil). Reporting requires a DoD-approved medium assurance certificate, so obtain one in advance.