DFARS 252.204-7012 Requirements, Clause by Clause

Almost every obligation discussed on this site traces back to one clause. DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting — has been in defense contracts since 2017, and it is the instrument that makes NIST SP 800-171 contractually binding rather than merely advisable.

It survived the 2026 CMMC suspension untouched, which is why the suspension changed less than the headlines suggested.

Four obligations

The clause does four separate things, and organisations tend to address the first and forget the rest.

1. Adequate security. Implement NIST SP 800-171 on any covered contractor information system — anything that processes, stores or transmits covered defense information. Currently Revision 2, pinned by Class Deviation 2024-O0013. See Revision 2.

2. Cyber incident reporting within 72 hours. Rapid reporting to DoD of any incident affecting covered defense information or your ability to provide operationally critical support.

3. Media preservation and access. Preserve and protect images of affected systems for at least 90 days from the report, and provide DoD access on request.

4. Flow-down. Include the clause in subcontracts where the subcontractor will handle covered defense information. See flow-down requirements.

The 72-hour clock is shorter than it sounds

Seventy-two hours from discovery, not from resolution and not from certainty. You are expected to report while you still do not fully understand what happened.

The administrative trap is the mechanism. Reporting goes through the DIBNet portal, which requires a DoD-approved medium assurance certificate. Obtaining one takes time and identity verification. A contractor who discovers an incident on a Friday and starts the certificate process on the Monday has already lost the window.

Get the certificate before you need it. It is the cheapest piece of incident preparedness available and it is routinely left until the worst possible moment.

Cloud services and the equivalency question

Where a cloud provider holds covered defense information for you, the clause requires that provider to meet FedRAMP Moderate or equivalent, and to satisfy the incident reporting and media preservation terms.

“Or equivalent” is where the cost decisions live. Microsoft 365 GCC High is purpose-built for the position; commercial Microsoft 365 may be defensible for some scopes, but the burden of holding the body of evidence demonstrating equivalency falls on you, not on the provider.

Make that decision deliberately and write it down. An assessor will ask, and “our IT provider said it was fine” is not the body of evidence. The cost implications are covered on the cost guide.

What counts as covered defense information

Unclassified controlled technical information or other information described in the CUI Registry that requires safeguarding, and that is either marked and provided to you in connection with the contract, or collected or generated by you in performing it.

Two parts of that definition get missed. Information you generate counts, not only what you receive — so a model derived from a government drawing is in scope. And the Registry is the arbiter of what qualifies, which means a label a customer invents does not create CUI, though it may still create a contractual obligation. See CUI categories.

What reporting an incident does not do

Two anxieties keep contractors from reporting, and the clause addresses both directly enough that they are worth stating plainly. Submitting a report is not an admission that you failed to implement adequate security — the clause contemplates that incidents occur at compliant organisations, and the reporting obligation exists precisely because they do. Nor does the submission waive anything: the clause preserves the contractor’s rights in the information submitted and restricts how DoD may use and further disclose it.

What does create exposure is the pattern that follows a decision not to report: an incident discovered later through another route, a 72-hour window long closed, and a contemporaneous record showing the organisation knew. That converts a security event into a compliance failure and, where representations about security posture were made to win the work, potentially into a False Claims Act matter. The asymmetry is stark enough that the reporting decision is rarely a close call.

Why 7012 outlived the CMMC suspension

The July 2026 suspension and Class Deviation 2026-O0025 Revision 3 reached 252.204-7021, the CMMC clause — the mechanism that made third-party certification a condition of award.

7012 is a different instrument with a different history. It predates CMMC by several years, and nothing in the suspension touched it. Nor did anything touch 7019 and 7020, which require the self-assessment and the posted SPRS score.

So the honest summary is that the verification layer was removed and the underlying obligation was not. If your contracts carry 7012, you owe the same things you owed in June. See program status.

To check how your environment measures up against the clause, a CMMC gap assessment scores all 110 NIST SP 800-171 requirements it points to.