DFARS

Defense Federal Acquisition Regulation Supplement

Contractual cybersecurity mandates for DoD suppliers, centered on DFARS clause 252.204-7012 and NIST SP 800-171.

Get Free Security Assessment

View All Compliance Frameworks

What It Is

DFARS is the Department of Defense’s supplement to the Federal Acquisition Regulation (FAR). Its central cybersecurity clause, DFARS 252.204-7012, requires contractors to implement the security requirements of NIST SP 800-171, report cyber incidents to the DoD within 72 hours of discovery, and preserve forensic evidence for review.

DFARS also requires these obligations to flow down to subcontractors handling the same covered defense information. It forms the contractual and legal baseline that CMMC was created to independently verify, so most CMMC Level 2 work is, in practice, DFARS 800-171 implementation work.

Who It Applies To

Any contractor or subcontractor performing on a DoD contract that includes the DFARS 252.204-7012 clause, particularly those that create, receive, or transmit Controlled Unclassified Information (CUI) in the course of contract performance.

How We Help

  • Implement and document the 110 NIST SP 800-171 security controls

  • Stand up a 72-hour DoD cyber incident reporting procedure

  • Maintain System Security Plans (SSPs) and POA&Ms as contractual evidence

  • Correctly flow down security requirements to your subcontractors

  • Build a control baseline that carries directly into CMMC Level 2 readiness

Ready to close your compliance gaps?

Get a free security assessment, no obligation.

Get Free Security Assessment