DFARS 7012

What is the difference between CMMC and DFARS 7012? 

DFARS 7012 is the contract clause that sets the safeguarding and reporting obligations for controlled unclassified information on nonfederal systems. The Cybersecurity Maturity Model Certification (CMMC) program verifies compliance. In simple terms, DFARS 7012 tells contractors what must be done, while the CMMC is the enforcement and assessment layer. 

DFARS 7012 went into effect in 2016 to address data breaches and increasing cybersecurity threats within the Defense Industrial Base (DIB). While the DFARS 7012 compliance deadline was in 2017, the CMMC rolled out beginning November 10, 2025, to ensure contractors are following through on their obligations as many businesses remained noncompliant.  

What Information Systems and Data are in Scope of DFARS 7012? 

DFARS 7012 applies only to Covered Defense Information (CDI), an umbrella term for Controlled Unclassified Information (CUI) from the DoW, that must be protected when furnished by the DoW or generated in direct performance of the contract. 

Contractors may handle multiple types of CUI, but only information contractually identified as CDI is in scope for DFARS 7012. If a DIB organization handles CDI as defined by the contract, the first step is to identify how it is handled and where it resides in their information systems. 

CDI can exist in many places across an organization’s systems. It can be found in emails, collaboration systems, file shares, proposal systems, and many other locations, depending on the contract. 

What Does DFARS 7012 Require? 

DFARS 7012 has 3 primary requirements: 

1. Contractors must provide adequate security and safeguard CDI (paragraph b) 

2. Contractors must report cyber incidents (paragraphs c-g) 

3. Flowdown (paragraph m) 

As a baseline, every company must have a System Security Plan (SSP) outlining how the organization addresses the requirements above. They must also document all in-scope systems and controls.  

1. Provide Adequate Security and Safeguard CDI 

DFARS 7012 covers two types of systems: ones operated by the government and fully nonfederal systems. Most DoW contractors focus on the latter, as they mostly relate to their internal IT support and collaboration systems. 

 

Systems Operated on Behalf of the Government: 

DFARS 252.204-7012 (b)(1) defines covered contractor information systems that are part of an IT service or system operated on behalf of the government, the following stipulations apply: 

(i) The DISA SRG v1r3 specifies the NIST 800-53r4 as the control set that must be implemented to be compliant. 

(ii) The contractor shall implement the appropriate safeguards and controls in accordance with the DISA Cloud Computing Security Requirements Guide (DISA SRG v1r3), unless the DoW CIO has waived the requirement. 

A contractor must operate systems on behalf of the government in accordance with the DISA SRG v1r3 and the NIST 800-53r4 control set. These systems require meeting the 110 controls within NIST 800-171. However, if the contractor uses an external Cloud Solution Provider (CSP), that CSP environment must be, at a minimum, FedRAMP Moderate compliant. 

Nonfederal Systems: 

DFARS 252.204-7012 (b)(2) defines covered contractor information systems that are not part of in IT service or system operated on behalf of the Government and are not subject to the security requirements specified in (b)(1); however, the following security requirements apply: 

(i) The covered contractor systems shall be subject to NIST 800-171 

(ii) The contractor shall implement NIST 800-171 and if the contractor intends to use an external cloud service provider, then the cloud service provider must meet the requirements established by FedRAMP Moderate and comply with paragraph (c) through (g) 

Bottom line, the DFARS requirements levy a much higher set of requirements on systems operated on behalf of the government than they do nonfederal systems. This is good news for contractors, but it is still a significant undertaking for almost all organizations. 

2. Reporting Cyber Incidents 

Contractors must report cyber incidents involving CDI within 72 hours. For their report, they must preserve and submit logs, images, and malicious code for a minimum of 90 days. This includes providing access to cloud environments hosting CDI. 

Note: These reporting requirements mean that both the contractor and any cloud computing service it uses must maintain a running 90-day log and provide system images for any systems that store, process, or transfer CDI or CUI. Those needs are why many organizations choose Microsoft 365 Government Community Cloud (GCC) or GCC High. 

As mentioned above, if a reported cyber incident occurs, the subcontractor or contractor must also submit the malicious software here: https://dibnet.dod.mil/portal/intranet/. 

3. Contract Flowdown 

The third primary component of the DFARS 7012 clause requires all prime contractors and subcontractors to include the DFARS 7012 clause, in its entirety. Subcontractor flowdown includes all CDI-handling subs, regardless of their scope. 

This component ensures that all potential providers or organizations that could have access to CUI/CDI data are covered by the DFARS 7012 clause.  

What does DFARS 7012 compliance cost? 

The cost of implementing DFARS 7012 varies based on company size and environment complexity, but it is typically a six-figure problem. 

Larger organizations with thousands or tens of thousands of employees could easily reach seven figures or higher to ensure compliance. Thankfully, many of these costs are included in the cost of CMMC implementation.  

While the DoW has never estimated the cost of DFARS 7012 implementation, the FAR council has estimated the cost of NIST 800-171 revision 2 implementation and maintenance.  

The total estimated labor cost for a small business in the initial year is approximately $148,200 (average of 1,560 hours * $95), with a recurring annual labor cost of approximately $98,800 (1,040 hours * $95). The total estimated labor cost for a business other than a small business in the initial year is approximately $543,400 (average of 5,720 hours * $95), with a recurring annual labor cost of approximately $494,000 (5,200 hours * $95). Note, this does not include the time expected to maintain the system security plan (see section IV.C.2.d. of this preamble). 

Though it might sound counterintuitive, using a high-quality managed services solution, like Summit 7’s Guardian, Vigilance, or Commander, can amount to significant cost savings over fully insourcing compliance.  

Where do DFARS and CMMC overlap?  

DFARS 7012 and CMMC overlap in several fundamental ways. At the outset, CMMC requirements are established in DFARS via DFARS 7021; every DIB supplier will have both requirements moving forward: 

• Shared flowdown requirements 

• Shared implementation of NIST 800-171 

Also, the same flowdown requirements are present in CMMC, and all subcontractors must follow similar requirements as the prime. Lastly, the most common thing shared among both regulations, is the shared implementation of NIST 800-171. CMMC Level 2 includes all of NIST 800-171’s 110 controls. 

Next Steps 

1. Assess whether your company has DFARS 7012 in their current contracts and identify CUI.  

2. Assess your company’s implementation of NIST SP 800-171 in its information systems.  

• Update the SSP if any gaps are identified and remedied. 

3. Assess and validate that all subcontractors have an SSP and have successfully implemented NIST SP 800-171.  

4. If your company uses cloud systems, determine if its platforms will meet compliance. We recommend Microsoft 365 GCC High to meet DFARS 7012 and CMMC 2.0 Level 2. 

5. Complete a Basic Assessment (self-assessment) and submit the results to the Supplier Performance Risk System (SPRS). 

6. Understand each element in the DFARS 70 Series: 7012, 7020 (now 252.240-7997), 7021. 

Our team of compliance and cybersecurity experts are on standby and ready to help. Reach out to learn more about your compliance obligations.