DFARS 252.204-7012

Also known as: DFARS 7012, 252.204-7012, DFARS cybersecurity clause, Safeguarding Covered Defense Information

DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting — US Department of Defense (DoD)

Official site Official change log

The contract clause that makes NIST SP 800-171 binding on defense suppliers and requires a cyber incident affecting covered defense information to be reported to DoD within 72 hours, with media preserved for 90 days. It predates CMMC by seven years — the clause was created in November 2013 (2013-27313) — and continues to apply on its own terms alongside it.

Subscribe to DFARS 252.204-7012 (RSS)

Timeline

No changes recorded yet — we are watching, and nothing has been published.

Monitoring

Watched by 1 official source. Watching since 20 September 2026.