DFARS 252.204-7012 in Plain English

Most of the anxiety in the defense industrial base right now is aimed at CMMC. That is the wrong target. CMMC is an assessment framework, and it is currently paused halfway through implementation. The clause that actually obligates you sits in your contracts today, has for years, and was not touched by the suspension.

DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.” Thirteen lettered paragraphs. If you read one thing in your contract file this quarter, read this one — and here is what it says in ordinary language.

When it applies to you

It goes in all Department solicitations and contracts, including those for commercial items, with one narrow exception: acquisitions solely for commercially available off-the-shelf items. If you are selling standard bolts out of a catalogue, it does not apply. If you are making anything to a Government drawing, it very likely does.

It also arrives through primes. Paragraph (m) requires the clause to be flowed down into subcontracts involving covered defense information or operationally critical support. A great many small shops hold 7012 obligations without ever having seen a Government contract.

(a) The definitions do the heavy lifting

Covered defense information is unclassified controlled technical information or other information described in the CUI Registry that requires safeguarding or dissemination controls, and that is either marked and provided to you in support of the contract, or collected, developed, received, transmitted, used or stored by you in performance of it.

Read the second half of that again. Information you generate in performance of the contract counts. The manufacturing process you developed from the Government’s drawing is covered defense information even though nobody handed it to you with a banner marking on it. This is the single most commonly missed sentence in the clause.

Covered contractor information system is an unclassified system that you own or operate which processes, stores or transmits covered defense information. That is the definition that determines your boundary, and it is broader than “the server.”

Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing on it. Note “potentially adverse.” The threshold is lower than most people assume, and it is deliberately lower than “we confirmed a breach.”

Rapidly report means within 72 hours of discovery. Not 72 hours from confirmation, or from the incident response firm’s findings, or from Monday. From discovery.

(b) Adequate security means NIST SP 800-171

You must provide adequate security on all covered contractor information systems, and for anything not in a Government cloud, that means implementing NIST SP 800-171 — the full 110 requirements. The deadline for doing so was 31 December 2017.

Three things fall out of that:

• It is not a maturity model. There are no levels here. 7012 is all 110, or a documented variance approved by the Department CIO.
• The revision matters. Rev. 2 is what is currently required. Rev. 3 was finalised in 2024 and rearranged the standard into 97 requirements across 17 families, but it has not been adopted for DFARS scoring or CMMC. The FAR Council’s proposed CUI rule from June 2026 references Rev. 3, which is a mismatch worth watching but not yet worth acting on.
• The deadline is nine years in the past. There is no grace period left to be inside of. This is the fact that makes the “we’re waiting to see what happens with CMMC” position untenable.

If you use an external cloud service to store, process or transmit covered defense information, that provider must meet security requirements equivalent to the FedRAMP Moderate baseline and must comply with the clause’s reporting, preservation and access paragraphs. That sentence is the reason a general-purpose commercial tenant is usually the wrong home for CUI, and it applies to every service — file sharing, email, ERP, CAD, and anything an employee signed up for last month.

(c) The 72-hour clock, and the certificate you do not have

On discovering a cyber incident affecting a covered system, covered defense information, or your ability to perform operationally critical support, you conduct a review for evidence of compromise and rapidly report to the Department at dibnet.dod.mil.

Here is the practical failure nobody plans for: submitting that report requires a DoD-approved medium assurance certificate. Obtaining one takes weeks. If you start the process at hour four of a live incident, you will miss the 72-hour window while waiting on paperwork.

Get the certificate now, while nothing is on fire, and make sure at least two people can use it. Then test that they can actually log in — annually, on the same day you do something else memorable. A certificate that expired eleven months ago is functionally the same as not having one.

Note also what the clause does not say: it does not say report only confirmed breaches, and it does not condition reporting on your own conclusions about severity. The review is for evidence of compromise; the report follows the discovery.

(d) through (g) The obligations after the report

Paragraph	What it requires	The part people get wrong
(d) Malicious software	Submit discovered malicious software to the DoD Cyber Crime Center	It goes to DC3 separately — do not attach malware to the incident report
(e) Media preservation	Preserve images of affected systems and relevant monitoring and packet capture data for at least 90 days from report submission	Images, not just logs. And the instinct to reimage and move on destroys the evidence you are required to keep
(f) Access for forensics	Provide access to additional information or equipment if the Department requests it	Have a named point of contact and know who authorises this before you are asked
(g) Damage assessment	If the Department conducts a damage assessment, provide the media and information preserved under (e)	This is why (e) is not optional housekeeping

Paragraph (e) is the one to internalise. Your instinct after an incident — and your insurer’s instinct, and often your incident response firm’s instinct — is to restore service fast. The clause requires the opposite for at least 90 days: capture images before you rebuild, and keep them.

(h) through (l) The Department’s side of the bargain

These paragraphs get skipped, and they are the ones that answer the objection people actually have, which is “why would I volunteer information about my own security failures?”

They govern how the Department safeguards and uses contractor attributional and proprietary information reported under the clause, and they limit its release. There are meaningful constraints on what happens to what you report. That is not a guarantee against every consequence, and it is worth reading the actual text with counsel before an incident rather than during one — but the framework is not “report it and hope.”

Paragraph (l) is also worth knowing: reporting under this clause does not relieve you of any other reporting obligation. State breach notification laws, contract-specific requirements, and your prime’s contractual notice provisions all still apply, and they run on different clocks.

(m) Flow-down, and what it costs you

You include the clause, without alteration except to identify the parties, in subcontracts for operationally critical support or where the subcontract involves a covered contractor information system. Your subcontractor reports incidents to the Department directly and provides you the incident report number.

What that means in practice is that your compliance depends on companies you do not control. The machine shop doing your heat treat, the engineering firm doing your stress analysis, the IT provider holding your backups. If covered defense information reaches them, the clause reaches them, and you are the one who has to have flowed it down.

Pull your subcontract templates and check. In my experience this is the most common single gap, because the flow-down was never added when the prime contract changed.

Four things the clause does not say

• It does not mention CMMC. Not once. 7012 stands entirely on its own, and it was in force for years before CMMC existed. The suspension of Phase 2 has no effect on it whatsoever.
• It does not require a certificate, an auditor or a product. No vendor is required. No assessment body is required. Anyone selling you something as “required by 7012” is describing a means, not the requirement.
• It does not require information to be marked. Covered defense information includes what you develop in performance of the contract. The absence of a banner marking is not a determination that something is out of scope — though it does raise a question you should ask in writing, which is where marking practice and contract language get interesting.
• It does not offer a small business exception. Fourteen people or fourteen thousand, the clause reads the same.

What I would do this week

• Search every active contract and subcontract for 7012. Make a list of which ones have it.
• For each, identify what covered defense information you actually hold and where it lives right now.
• Apply for the medium assurance certificate if you do not have one, and name two people who can use it.
• Write the incident response procedure to preserve images first and restore second, and put the 72-hour clock and the dibnet submission step in it explicitly.
• Check your subcontract template for the (m) flow-down.
• Confirm your SPRS score reflects your actual 800-171 state, and that you can defend the number with a System Security Plan if asked.

None of that depends on how the CMMC Reform Task Force comes out. That is the point. The programme people are watching is downstream of a clause that has been sitting in the file the whole time — and the honest reason to work on 7012 is not that someone will check, but that the obligation is real whether or not anyone does.

For the current state of the broader programme, see Is CMMC Cancelled? For which level of assessment applies to you, see Level 1 vs Level 2.

---

Where to go next

• Want to know where you stand against the 110? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks the clause and the standard together.
• Need the incident response procedure, the flow-down language and the SSP in one place? Start with our CMMC packets.