DFARS 252.204-7012

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-07-13 DoD CIO memo suspending CMMC Phase 2 requires baseline compliance with NIST SP 800-171 Rev 2 under DFARS 252.204-7012
2. 2025-11-10 DFARS rule putting CMMC assessment requirements into DoD contracts takes effect
3. 2017-12-31 Deadline in the clause for contractors to implement NIST SP 800-171
4. 2013-11-18 Original DFARS safeguarding clause takes effect

1. 2024-05-30
   DFARS 252.204-7012 (MAY 2024) ErrataCurrent text

   Editorial update of two outdated hyperlinks in the clause. source

2. 2023-01-31
   DFARS 252.204-7012 (JAN 2023) Revision

   Replaced "commercial items" terminology with "commercial products or commercial services" and edited the definition of technical information. source

3. 2019-12-31
   DFARS 252.204-7012 (DEC 2019) Errata

   Technical amendment updating internet hyperlinks in the clause. source

4. 2016-10-21
   DFARS 252.204-7012 (OCT 2016) Revision

   Final rule adopting, with changes, the 2015 interim rules on network penetration reporting and contracting for cloud services. source

5. 2015-12-30
   Second interim rule (December 2015) Amendment

   Gave contractors until 31 December 2017 to implement NIST SP 800-171 and narrowed the subcontract flowdown. source

The clause binds DoD contractors whose systems hold covered defense information to NIST SP 800-171 and DoD's incident reporting rules.

Security baseline

Covered contractor information systems must implement NIST SP 800-171, in the version in effect when the solicitation is issued or as authorized by the contracting officer. source

Rev. 2 baseline

Since July 2026 DoD requires baseline compliance with NIST SP 800-171 Rev 2 under this clause. source

Cloud services

An external cloud provider holding covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline and the clause's incident duties. source

Subcontracts

The clause flows down without alteration to subcontracts for operationally critical support or involving covered defense information, including commercial ones. source

Prescription

Under class deviation 2026-O0025 the clause is prescribed for solicitations and contracts, including commercial ones, except those solely for COTS items. source

The contractor implements NIST SP 800-171 itself; DoD checks it through separate assessment clauses and CMMC.

Variances

Requests to vary from NIST SP 800-171 go in writing to the contracting officer for DoD CIO consideration. source

DoD assessments

Under class deviation 2026-O0025, clause 252.240-7997 covers NIST SP 800-171 DoD Assessments in contracts. source

CMMC

CMMC Level 2 checks the requirements of NIST SP 800-171 Rev. 2; since July 2026 DoD permits Level 1 and Level 2 self-assessments in procurement requests. source source

DoD enforces the clause through the contract: rapid incident reporting, evidence preservation and assessment of compliance after incidents.

72-hour reporting

Cyber incidents affecting covered defense information or operationally critical support must be reported to DoD at dibnet.dod.mil within 72 hours of discovery. source

Media preservation

Images of affected systems and relevant monitoring data must be kept for at least 90 days after the report. source

Medium assurance certificate

Reporting requires a DoD-approved medium assurance certificate. source

After an incident

Contracting officers consider reported incidents in assessing whether the contractor has met the clause's requirements. source

1. Law text DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
2. Law text DFARS Class Deviation 2026-O0025 Rev. 3 (DFARS Part 240; CMMC Phase 2 suspension)
3. Guidance DoD Cyber Incident Reporting portal (DIBNet)
4. Law text Final rule on network penetration reporting and cloud services (21 October 2016)

1. NIST SP 800-171

   NIST SP 800-171 is the list of security requirements; DFARS 252.204-7012 is the contract clause that makes it binding on DoD suppliers and adds incident reporting.

2. CMMC

   CMMC is DoD's assessment and certification program; DFARS 252.204-7012 is the underlying safeguarding and reporting duty that keeps applying alongside it.

3. FAR 52.204-21

   FAR 52.204-21 is a basic governmentwide floor for Federal contract information; DFARS 252.204-7012 applies NIST SP 800-171 to DoD covered defense information.

4. FedRAMP

   FedRAMP authorizes cloud services for federal agencies; the clause requires DoD contractors' cloud providers to meet FedRAMP Moderate-equivalent requirements.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to DFARS 252.204-7012 (RSS)