What is DFARS 252.204-7012?

DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) is a Defense Federal Acquisition Regulation Supplement clause that requires DoD contractors to implement NIST SP 800-171 security requirements, report cyber incidents to the DoD within 72 hours, and use cloud services that meet FedRAMP Moderate or equivalent standards when processing CUI.

What are the requirements of DFARS 252.204-7012?

DFARS 252.204-7012 requires contractors to: (1) implement NIST SP 800-171 security controls to safeguard covered defense information; (2) report cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours of discovery; (3) preserve images of compromised systems; (4) submit malicious software to DC3; and (5) use only cloud services that meet FedRAMP Moderate or equivalent security requirements for CUI processing.

Does DFARS 252.204-7012 require cloud storage?

DFARS 252.204-7012 does not require you to use cloud storage, but if you do use cloud services to process, store, or transmit Covered Defense Information (CDI) or CUI, those cloud services must meet or exceed FedRAMP Moderate security requirements. Microsoft 365 GCC High and AWS GovCloud are common options that satisfy this requirement.

What is the difference between DFARS 7012 and CMMC?

DFARS 252.204-7012 is the existing clause that requires NIST 800-171 implementation and relies on contractor self-attestation. CMMC (under DFARS 252.204-7021) adds a verification layer — requiring third-party assessment by a C3PAO for Level 2 contracts involving CUI. CMMC does not replace DFARS 7012; both clauses will appear in DoD contracts. DFARS 7012 establishes the baseline requirement; CMMC verifies it was actually met.

DFARS 252.204-7012 Compliance

Home
DFARS 252.204-7012 Compliance

"The foundational DoD cybersecurity contract clause — enforce it, don't just sign it."

CMMC Gap Analysis SPRS Score Assessment CUI Enclave Design Microsoft GCC High Licensing PreVeIL Encrypted Collaboration Managed SOC & Compliance NIST 800-171 Consulting CMMC Readiness Consulting C3PAO Preparation DFARS 252.204-7012 NJ CMMC Consulting CMMC for Manufacturers CMMC for Machine Shops

DFARS 252.204-7012 — The Contractual Foundation of CMMC

DFARS 252.204-7012 requires DoD contractors to safeguard CUI using NIST SP 800-171, report cyber incidents within 72 hours, and use cloud services that meet FedRAMP Moderate or equivalent. VIS LLC implements the technical controls required by the clause — CUI safeguarding, incident reporting infrastructure, and cloud security baseline.

DFARS 252.204-7012 has been in DoD contracts since 2015. The False Claims Act creates liability for contractors who certify compliance without actually implementing it. VIS LLC builds the technical implementation — so your DFARS compliance certification is backed by real controls.

Key Features

CUI safeguarding controls per NIST 800-171

We implement the 110 NIST 800-171 controls required to safeguard CUI under the DFARS clause — in code, not just on paper.

72-hour cyber incident reporting capability

We implement the technical infrastructure required to detect, document, and report cyber incidents to DoD within the 72-hour window.

Cloud service compliance (FedRAMP Moderate)

We assess and configure your cloud services to meet the FedRAMP Moderate or equivalent requirement of the DFARS clause.

CUI flow mapping and data handling

We map where CUI enters, moves through, and exits your environment to ensure the DFARS safeguarding requirements are applied everywhere CUI lives.

SPRS self-assessment submission support

We support your NIST 800-171 self-assessment and SPRS score submission to the Supplier Performance Risk System.

Ongoing compliance monitoring

We configure ongoing monitoring to detect changes that would affect your DFARS compliance posture between self-assessments.

Ready to get started?

Schedule a free consultation with our CMMC experts.

DFARS Compliance Assessment

DoD Contractors — Is Your CMMC Compliance Audit-Ready?

Book Free Assessment