DFARS 7012 in Plain English: What 252.204-7012 Requires From a Small Defense Shop

What is DFARS 252.204-7012?

DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” is a clause the DoD puts in contracts where the contractor will handle covered defense information. It requires adequate security on your systems, rapid incident reporting, malware submission, media preservation, and flowdown to subcontractors. The current text on acquisition.gov is dated May 2024.

Covered defense information means unclassified controlled technical information and other CUI Registry information that’s identified in your contract or that you handle to perform it. For a machine shop, that’s usually the drawing package. If you’re not sure what counts, start with our guide to CUI.

It applies to any unclassified system you own or operate that “processes, stores, or transmits covered defense information.” That’s your file server, email, laptops, and any cloud service the drawings pass through.

What does "adequate security" mean under 7012?

For most contractors, adequate security means implementing NIST SP 800-171 on every covered system. Paragraph (b)(2) says those systems “shall be subject to the security requirements in” NIST SP 800-171. The clause text says the version “in effect at the time the solicitation is issued,” but a DoD class deviation (2024-O0013, Revision 1) requires contractors to comply with Revision 2 “instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued.” It “remains in effect until rescinded.” Rev 2 is also the version the CMMC rule is built on.

Our CMMC Level 2 requirements guide covers what the 110 requirements look like in practice, and our Rev 3 explainer covers why Rev 2 is still the one that counts.

The clause adds a few more duties under paragraph (b):

• Variances. If you can’t meet a requirement, you ask the contracting officer in writing. The DoD CIO decides. You don’t get to decide on your own that a control doesn’t apply.
• Cloud providers. If an external cloud service will “store, process, or transmit any covered defense information,” you have to make sure it “meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” The provider also has to follow the clause’s incident reporting, malware, media preservation, and forensic access rules.

The cloud rule is the one that catches small shops. It covers every cloud service the drawings touch, including email and file sharing, and the burden is on you to check. That’s a big reason defense suppliers look at GCC High, which we cover in our GCC High and CMMC guide.

What does 7012 require when you have a cyber incident?

When you discover a cyber incident that affects a covered system or the covered defense information on it, paragraph (c) requires two things. First, review for evidence of compromise: which computers, servers, data, and user accounts were hit. Second, “rapidly report” it to DoD. The clause defines that as “within 72 hours of discovery of any cyber incident.”

The clock starts at discovery, not when you finish investigating. The clause defines a cyber incident broadly: anything done through computer networks that results in “a compromise or an actual or potentially adverse effect” on a system or its information. A compromised mailbox that held drawings counts.

The rest of the incident duties:

• Report through DIBNet. The clause sends you to dibnet.dod.mil. As of late September 2026, that address forwards to the DC3 DCISE page, which links to the reporting portal. DCISE calls itself “the single focal point and data repository for DIB cyber incident reporting required by” DFARS 252.204-7012.
• Have the certificate. Paragraph (c)(3) says the contractor or subcontractor “shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents.” DC3’s page says the certificate is required to access the portal and lists IdenTrust and WidePoint as approved External Certification Authority vendors.
• Submit malware to DC3, not your contracting officer. If you isolate malicious software, paragraph (d) says to send it to the DoD Cyber Crime Center following their instructions. DC3’s page adds: “Do not email malicious files.”
• Preserve images for 90 days. Paragraph (e) requires you to “preserve and protect images of all known affected information systems” and “all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report.”
• Give DoD access if asked. Paragraphs (f) and (g) cover forensic analysis and damage assessment requests.

How does 7012 flow down to subcontractors?

Paragraph (m) requires the prime to put 7012 in subcontracts that involve covered defense information or operationally critical support, “without alteration, except to identify the parties.” That includes subcontracts for commercial products and services. If you’re a sub with CUI drawings, you carry the same clause your prime does.

Subs have two extra duties. Tell the next tier up when you ask for a variance from an 800-171 requirement. And when you report an incident, give your prime the incident report number DoD assigns “as soon as practicable.” You still report to DoD yourself.

How does 7012 relate to 7019, 7020, 7021, and CMMC?

7012 sets the duty. The other three are about proving it:

• 252.204-7019 is a solicitation provision. If you’re required to implement 800-171, you need a current assessment, “not more than 3 years old unless a lesser time is specified,” posted in SPRS to be considered for award.
• 252.204-7020 defines the Basic (self), Medium, and High assessments, requires you to give the government access for Medium or High assessments, and says how summary scores reach SPRS. Our SPRS score guide walks through the scoring.
• 252.204-7021 is the CMMC clause. It requires you to keep a current CMMC status at the level the contracting officer fills in, for every system that handles FCI or CUI on the contract, and to flow the right level down.

That’s the clause set as codified, and it changed for new solicitations in 2026. Class Deviation 2026-O0025 took effect February 1, 2026, and Revision 3 was signed September 3, 2026. It tells contracting officers to use a rewritten DFARS Part 240. 7012 and 7021 stay. 7019 isn’t in the new clause list. 7020 becomes 252.240-7997, which covers only the government-run Medium and High assessments. Your self-assessed score goes into SPRS under the CMMC clause and 32 CFR 170.16. Older contracts can still carry 7019 and 7020, so check the clauses in yours. Our SPRS score guide covers the details.

CMMC Level 2 assesses the same 800-171 requirements 7012 already required. CMMC didn’t create the obligation. It created a way to check it. For the bigger picture, see what CMMC is.

Did the CMMC Phase 2 suspension change 7012?

No. The July 13, 2026 memo suspending the Phase 2 transition limits new contracts to Level 1 (Self) and Level 2 (Self) during the review, and says DFARS 252.204-7012 stays in effect. The pause moved third-party audits back. It didn’t move the 72-hour clock, the certificate, or 800-171.

What should a small shop have ready before an incident?

Have the reporting path, the certificate, and the evidence ready before anything happens. Seventy-two hours is not much time to get a certificate, decide who reports, and find your logs. Here’s the short list:

1. A written incident response plan that names who decides something is a cyber incident, who files the DoD report, and who calls your prime. Our incident response plan template has the eight sections, and you can add a 7012 line to the outside-calls section.
2. The medium assurance certificate, already issued and installed for the person who will report, with a backup person.
3. The contacts printed out: the DCISE line, your prime’s security contact, your contracting officer, your insurer, and your IT provider. Your email may be what’s down.
4. Logs that go back far enough to answer paragraph (c)(1)(i): which computers, accounts, and data were touched. That means sign-in logs, endpoint alerts, and firewall logs kept off the systems an attacker would wipe.
5. A way to image systems and hold the images and capture data for at least 90 days after the report, stored where nobody reuses the drive.
6. A cloud check. Confirm in writing that every cloud service holding covered defense information meets the FedRAMP Moderate equivalent bar.

Key takeaways

What this looks like when we do it

We’re not a C3PAO or a Registered Practitioner Organization, and we don’t do CMMC assessments. We don’t file your DoD report either. That’s your duty, under your certificate. Our job is making sure the evidence the clause asks for exists and the people who need to act know their part.

For a defense supplier, that means centralized sign-in and endpoint logs, firewall monitoring, an inventory that shows which machines hold drawings, and a plan that names who reports and who calls the prime. On the plant floor, we isolate legacy Windows and controllers, as we describe on our manufacturing IT page.

If your prime just sent a subcontract with 7012 in it and you’re not sure you could report within 72 hours, see how we support manufacturers, then book a call and we’ll go through it with you.