Meet DFARS 7012 safeguarding and incident duties with less effort

DFARS 252.204-7012 is a US Department of Defense contract clause titled Safeguarding Covered Defense Information and Cyber Incident Reporting. It requires contractors to provide adequate security for covered defence information, mainly by implementing NIST SP 800-171, to report cyber incidents to DoD within 72 hours, to preserve evidence and malicious software, and to flow the clause down to relevant subcontractors. The current version is dated May 2024.

Any contractor or subcontractor whose DoD contract includes DFARS 252.204-7012 and whose systems process, store or transmit covered defence information must comply, as must suppliers of operationally critical support. Prime contractors must include the clause in relevant subcontracts without alteration, including subcontracts for commercial products and services, so suppliers outside the US, including UK businesses, can be bound by it through the supply chain.

Covered defense information is unclassified controlled technical information or other information listed in the Controlled Unclassified Information (CUI) Registry that needs safeguarding or dissemination controls. It is covered when it is marked or identified in the contract and provided by DoD, or when it is collected, developed, received, transmitted, used or stored by the contractor in support of the contract. In practice it is the CUI a defence contractor handles.

Contractors must rapidly report cyber incidents, defined as within 72 hours of discovery, to DoD through the DIBNet portal at dibnet.dod.mil, using a DoD-approved medium assurance certificate. They must review affected systems for compromise, submit any isolated malicious software to the DoD Cyber Crime Center, keep images of affected systems and monitoring data for at least 90 days, and give DoD access for forensic analysis on request.

Failing to meet DFARS 7012 is a breach of contract, which can lead to contract remedies, lost awards or termination. Because contractors represent that they meet the clause, inaccurate claims about NIST SP 800-171 implementation have also been pursued by the US Department of Justice under the False Claims Act. The clause itself does not set fixed fines, so consequences depend on the contract and the facts.

DFARS 7012 is the contract clause that requires NIST SP 800-171 on covered contractor information systems, and NIST SP 800-171 is the list of 110 security requirements contractors implement. CMMC, added to DFARS through clause 252.204-7021 from November 2025, is the programme DoD uses to verify that implementation through self-assessments or third-party assessments. DFARS 7012 continues to apply alongside CMMC.

ISO 27001 is a voluntary, certifiable international standard for an information security management system, while DFARS 7012 is a binding US defence contract clause with specific technical and incident reporting duties. Many controls overlap, such as access control, logging and incident response, so evidence collected for ISO 27001 can support NIST SP 800-171, but ISO 27001 certification does not by itself satisfy DFARS 7012.

Yes, on request. DFARS 252.204-7012 is mapped in OneClickComply's control library and is available on request rather than live by default. Once enabled, you can map the clause to shared NIST SP 800-171 and CMMC controls, collect evidence automatically from connected tools, monitor controls continuously and get guidance from our in-house audit team. OneClickComply supports your compliance work but does not certify compliance.