DFARS 252.204-7012 explained, paragraph by paragraph

Which 7012 text your contract carries

DFARS 252.204-7012 is the clause that puts NIST SP 800-171 on your computers, sends your cyber incidents to DoD within 72 hours and decides which cloud you may use for drawings and specs. It does this whether or not your contract says anything about CMMC. Today two versions of its text are in use, and your contract carries one of them. Find the clause line in your contract's list of clauses (or in the flowdown list on a prime's purchase order): the date in brackets tells you which.

The deviated text comes from Class Deviation 2026-O0025, Revision 3, the same document that carries the CMMC pause into contracts. It tells contracting officers to insert the clause in solicitations and contracts, including those for commercial products and services, except those solely for commercially available off-the-shelf (COTS) items. And in the part about the pause, it names this clause as the baseline that stays:

So for a small shop the practical answer is the same under either text: Rev 2, all 110 requirements. The codified wording left the revision open (NIST published Rev 3 in May 2024 and marks Rev 2 withdrawn on 2024-05-14); the deviated wording closes it by name. Where the two NIST revisions differ is set out in CMMC vs NIST SP 800-171. The SPRS score that DoD checks before award comes from two neighbouring clauses, not this one; they have their own page, DFARS 252.204-7019 and -7020.

(a) The definitions that decide whether it applies

Paragraph (a) is where most of the clause's reach is set. Two terms do the work. Covered defense information (CDI) is the information you must protect; a covered contractor information system is any system that holds it. The rest of the clause only bites on those systems. If you have never sorted what you hold, start with what CUI is and FCI vs CUI: CDI is the DoD contract's slice of CUI. Not sure a print counts? Run it through the Is it CUI? tool, and see how CTI is marked on what arrives.

Notice what is missing: there is no size threshold and no dollar floor. A two-person shop that receives one controlled drawing under a DoD subcontract carrying the clause is bound by every paragraph below. The scope is the systems, so the cheapest move is usually to shrink them. The scoping worksheet walks through which machines, accounts and folders actually touch CDI.

(b) Adequate security: NIST SP 800-171 Rev 2

Paragraph (b) opens with a general duty, “adequate security on all covered contractor information systems”, then sets the minimum. Which minimum depends on who runs the system.

On the (b)(2) path the date that matters is old. The clause says to implement NIST SP 800-171 “as soon as practical, but not later than December 31, 2017”. A shop signing its first DoD subcontract today does not get a ramp: the requirement is already late on the day the clause lands in your purchase order. What it does get is a way to ask for an exception.

Two details are easy to miss. Under (C), an approval the DoD CIO gave you on an earlier contract is not automatic on the next one: you send a copy to the new contracting officer and ask for it to be recognised. And under (m)(2)(i) a subcontractor who files a request must also tell the prime (or the next tier up). Paragraph (b)(3) then adds a catch-all: extra measures when your own risk calls for them, which “may be addressed in a system security plan.”

The 110 requirements themselves are explained in what NIST SP 800-171 is, and you can work through them one by one in the NIST SP 800-171 checklist.

(b)(2)(ii)(D) Cloud services: FedRAMP Moderate or equivalent

One sentence in (b)(2)(ii) decides where a shop can keep its email and files. A cloud provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline and follow 7012(c) to (g).

“Shall require and ensure” puts the duty on you, not on the provider. The DoD CIO memo of 2023-12-21 says what “equivalent” means: 100 percent compliance with the latest FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with the body of evidence given to the contractor. FedRAMP Moderate Authorized offerings need no further assessment. The same memo holds the contractor, not the cloud provider, responsible for reporting a compromise of the service, so the provider's incident terms are your problem too.

The status words are the ones every CuiDeck compare page uses, read on each offering's own page in the FedRAMP Marketplace. Microsoft's own answer to (b)(2)(ii)(D) is GCC High, a separate government tenant. Equivalency gets a page of its own in FedRAMP Moderate equivalent, explained; the wider difference between the two programs is in CMMC vs FedRAMP, and the email and file options a small shop actually weighs are in GCC High alternatives.

(c) Reporting a cyber incident within 72 hours

Paragraph (c) is the part of the clause you meet on a bad day, so read it on a good one. It applies when you discover a cyber incident that affects a covered contractor information system or the CDI on it (or your ability to deliver operationally critical support). Two things are then owed: a review and a report.

The review in (c)(1)(i) is broader than the machine that tripped the alarm. You look for evidence that CDI was compromised, “including, but not limited to, identifying compromised computers, servers, specific data, and user accounts”, and you also look at the other systems on your network that may have been reached through the incident. Then (c)(1)(ii): “Rapidly report cyber incidents to DoD at https://dibnet.dod.mil.” The definition in (a) turns “rapidly” into a number: within 72 hours of discovery.

The report is filed with DoD, not sent to your contracting officer, and (c)(2) says it is treated as information created by or for DoD and must hold at least the elements listed at DIBNet. Nothing in the clause pauses the clock while the review runs: the 72 hours count from discovery, so you report what you know by then.

That certificate is the step that sinks the 72 hours. You cannot file without it, so it is the one part of the report you cannot leave for the day of the incident. The clause points to the DoD's External Certification Authority (ECA) program; on 2026-10-23 its page on the DoD Cyber Exchange listed two approved ECA vendors, WidePoint and IdenTrust. Get the certificate for the person who will file, store it where that person can reach it at 2 a.m., and note when it expires.

Fig. 02

It is easy to read a report as a confession. The deviated DFARS part 240 says otherwise, and asks the contracting officer to consult DoD's cyber security office before judging compliance:

(d)–(g) Malware, images and forensic access

Filing the report is not the end of (c). Four short paragraphs follow it, and each one assumes you kept evidence that a busy shop would normally throw away to get back to work.

Read the dates carefully. The duty to preserve starts at discovery; the 90 days are counted from the day you submit the report. If you report on day 3, the images stay until at least day 93. The systems in scope are the ones your (c)(1)(i) review identified, so a thin review also means a thin set of images.

Fig. 03

(h)–(l) What DoD promises, and what stays yours

Most of the second half of the clause binds the Government rather than you. It sets the rules for what DoD may do with your incident report. Read it once, because it explains why marking what you send is worth the trouble.

(m) Flowing the clause down to your suppliers

Paragraph (m) is why the clause reaches a ten-person shop that has never met a DoD contracting officer. 7012(m) requires the clause, including (m), in subcontracts for operationally critical support or whose performance will involve covered defense information, including subcontracts for commercial products or services, without alteration except to identify the parties.

That sentence is a test you run on every purchase order you send out. A plater, heat treater or inspection lab who needs the controlled drawing to do the job is getting CDI, so the clause goes on their PO, unaltered. A supplier who gets only a material spec and a quantity may not be. When it is unclear, (m)(1) tells you to ask the contracting officer; as a subcontractor, ask your prime in writing. Note too that CMMC does not alter FAR 52.204-21 or DFARS 252.204-7012: the CMMC level a supplier needs is a separate question, covered in CMMC requirements for small businesses.

Under (m)(2) you must also require two things of each subcontractor: tell you when it asks the contracting officer to vary from an 800-171 requirement, and give you the DoD incident report number when it reports.

An incident-response checklist for a small shop

The clause tells you what DoD expects after an incident; NIST SP 800-171 3.6.1 to 3.6.3 tell you to be ready before one: an incident-handling capability, incidents tracked and reported, and the capability tested. Below, both are folded into 19 steps in three phases. Put in your discovery time and report date, and the clock works out the two dates the clause sets.

A tabletop run needs no tools: pick a scenario (a phished mailbox on the laptop that holds the drawings), walk the first two phases and see which box nobody can tick. That box is your first job. For the rest of your 800-171 work, the POA&M template keeps the gaps you find in one place.

Questions shops ask about DFARS 7012

How we read the rules