DFARS 252.204-7012 Compliance Guide

What Is DFARS 252.204-7012?

DFARS 252.204-7012, formally titled "Safeguarding Covered Defense Information and Cyber Incident Reporting," is the contract clause that makes cybersecurity compliance mandatory for defense contractors. If this clause appears in your contract, you are legally required to implement NIST SP 800-171 security controls.

DFARS does not define the security controls — that is the job of NIST 800-171. DFARS does not certify your compliance — that is the job of CMMC. What DFARS does is enforce compliance by making it a contractual obligation with legal consequences for non-compliance.

Think of it this way: NIST 800-171 tells you what to do. CMMC verifies you did it. DFARS is why you must do it. For a complete comparison of all three frameworks, see our Federal Compliance Comparison Guide.

What DFARS 7012 Requires

The clause has four mandatory requirements. Every contractor with this clause in their contract must satisfy all four:

Related DFARS Clauses

DFARS 7012 does not operate alone. Three additional clauses were introduced to strengthen enforcement and create accountability:

In practice, most DoD contracts now include all four clauses (7012, 7019, 7020, and 7021). This means contractors must implement NIST 800-171, submit an SPRS score, be prepared for DoD audits, and eventually hold a CMMC certification.

Contractor Responsibilities

Beyond implementing the technical controls defined in NIST 800-171, DFARS places specific operational responsibilities on contractors:

• Maintain a current System Security Plan (SSP) that accurately describes your CUI environment
• Maintain a Plan of Action and Milestones (POA&M) for any controls not yet fully implemented
• Submit and keep current your SPRS score in the Supplier Performance Risk System
• Ensure every subcontractor who handles CUI also meets DFARS 7012 requirements
• Have a documented incident response plan with a 72-hour reporting capability
• Preserve and be prepared to provide images of affected systems for 90 days after a cyber incident

The Subcontractor Flow-Down Problem

One of the most frequently misunderstood aspects of DFARS 7012 is the flow-down requirement. If you are a prime contractor and any of your subcontractors process, store, or transmit CUI, those subcontractors must also comply with DFARS 7012 — including having their own SSP, their own SPRS score, and their own incident response capability.

Prime contractors are responsible for verifying subcontractor compliance. The DoD does not check your subs for you. If a subcontractor suffers a breach and was not compliant, the prime contractor bears the contractual liability.

This means you need to include DFARS 7012 in your subcontract agreements and periodically verify that your subcontractors are maintaining their compliance posture.

Common Mistakes Contractors Make

After working with dozens of defense contractors, these are the mistakes we see most often:

• Assuming their managed IT provider handles compliance — IT management and NIST 800-171 compliance are different disciplines
• Having no documented SSP or using a generic template that does not reflect their actual environment
• No incident response plan or no ability to report to DC3 within 72 hours
• Ignoring subcontractor flow-down requirements
• Submitting an SPRS score without understanding how it was calculated
• Confusing CMMC with NIST 800-171 — they are related but different obligations

Get DFARS Compliant with Hatty AI

Hatty AI helps defense contractors meet DFARS requirements correctly the first time — including documentation, SPRS scoring, incident response planning, and subcontractor compliance verification.

Related: NIST 800-171 Implementation Guide · NIST vs CMMC vs DFARS Comparison · DFARS Compliance Services · Incident Response Plan Template