Aliff SolutionsAliff Solutions
DFARS ClauseCybersecurity

DFARS 252.204-7012Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires DoD contractors and subcontractors handling Covered Defense Information (CDI) to implement NIST SP 800-171 security controls and report cyber incidents within 72 hours.

When This Clause Applies

Required in all DoD solicitations and contracts (including commercial items) except for COTS purchases. Flows down to all subcontractors handling CDI.

What This Means for Contractors

Contractors must implement all 110 NIST 800-171 controls (or document deficiencies in a System Security Plan + Plan of Action & Milestones). Must report cyber incidents to dibnet.dod.mil within 72 hours. Must preserve and protect images of affected systems for at least 90 days. Cloud services storing CDI must be FedRAMP Moderate equivalent or higher.

Common Pitfalls

  • 1Treating the SSP as a one-time document instead of a living artifact
  • 2Missing the 72-hour cyber incident reporting deadline
  • 3Using cloud services not equivalent to FedRAMP Moderate
  • 4Failing to flow the clause down to subcontractors handling CDI
  • 5Not posting current self-assessment score in SPRS

Related Topics

DFARS 252.204-7012NIST 800-171 complianceCDI safeguardingcyber incident reporting DoDCMMC NIST 800-171

Need help complying with DFARS 252.204-7012?

Aliff helps GovCon firms map clause requirements to deliverables, build compliance evidence, and respond to CO inquiries with confidence.