DFARS 252.204-7012 Guide: Safeguarding CDI, 72-Hour Reporting and Cloud Rules

Any US defence contractor or subcontractor whose systems hold covered defense information is bound by DFARS 252.204-7012, which requires NIST SP 800-171 security, FedRAMP Moderate equivalent cloud services, cyber incident reports to DoD within 72 hours of discovery, and preservation of forensic images for at least 90 days. The clause has been in defence contracts since 2015 and its current text is dated May 2024. CMMC, which arrived in contracts from 10 November 2025, verifies the same NIST SP 800-171 requirements but does not replace 7012, and the False Claims Act cases of 2025 show that misrepresenting 7012 compliance is costly. This guide covers who is in scope, each paragraph's obligation, the clause's relationship to CMMC and SPRS, enforcement, the identity and AI angle, and a compliance plan. Status line: clause text checked on acquisition.gov on 27 October 2026 (DFARS change of 7 May 2026, clause still MAY 2024). It is for defence industrial base security leads, compliance teams, IT providers and incident responders.

Key takeaways

• Revision 2 is still the baseline. The clause requires the NIST SP 800-171 version in effect at the time of solicitation or as authorised by the contracting officer, and a May 2024 DoD class deviation, reported by practitioners and reaffirmed in 2026, holds contractors to Revision 2 rather than Revision 3.
• 72 hours from discovery. "Rapidly report" is defined as within 72 hours of discovery of a cyber incident affecting a covered contractor information system or the covered defense information in it, submitted through DIBNet with a DoD-approved medium assurance certificate.
• Evidence must survive. Images of affected systems and relevant monitoring and packet capture data must be preserved for at least 90 days from submission of the report, and DoD may ask for access for forensic analysis.
• Cloud and SaaS count. Any external cloud service that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline and support the incident duties; email hosting was at the centre of a 4.6 million dollar settlement in 2025.
• CMMC verifies, 7012 obliges. The CMMC DFARS rule took effect on 10 November 2025, and practitioner reports say a July 2026 memo suspended Phase 2 third-party assessments; neither changes 7012, which still applies in full.

Scope: who and what is covered

• Who: contractors whose contract includes the clause, and subcontractors at every tier where the subcontract is for operationally critical support or involves covered defense information. Flowdown is mandatory and the clause must go in unaltered except to identify the parties, including in subcontracts for commercial products and services.
• Covered defense information (CDI): unclassified controlled technical information or other information in the CUI Registry that requires safeguarding, which is either provided to the contractor by or for DoD in support of performance, or collected, developed, received, transmitted, used or stored by or for the contractor in support of performance. In practice this is the defence subset of CUI. See the CUI Guide.
• Covered contractor information system: an unclassified information system owned or operated by or for the contractor that processes, stores or transmits CDI. This includes laptops, file shares, email, collaboration tools, engineering workstations, backups and any cloud service used for the work.
• Cyber incident: actions taken through computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information in it. "Potentially adverse" sets a low bar.
• Not covered: systems operated by or for the government as an IT service (those follow DoD's own requirements) and classified systems.

Key obligations

Related clauses that travel with 7012

For the requirement-by-requirement content of NIST SP 800-171 and CMMC levels, see the NIST SP 800-171 and CMMC 2.0 Guide.

Timeline and current status

The DoD class deviation pages could not be read directly when this guide was checked, so the 2024 and 2026 deviation details above rest on practitioner reports. Confirm current deviations with your contracting officer and the DPCAP class deviations list before relying on them. Whatever happens to CMMC timing, the 7012 duties apply now to every contract that contains the clause.

Enforcement and penalties

• Contract remedies: non-compliance is a breach of contract. DoD can use the SPRS score and assessment results in award decisions, require corrective action, and pursue standard contract remedies.
• False Claims Act: the Department of Justice treats knowingly false statements about cybersecurity compliance as fraud on the government, with whistleblowers sharing in recoveries.
• MORSECORP (26 March 2025, 4.6 million dollars): DOJ said the company used a third-party email host from January 2018 to September 2022 without ensuring it met FedRAMP Moderate equivalent requirements, reported a SPRS score of 104 in January 2021 when a consultant later calculated minus 142, and had no consolidated system security plan for a period.
• Raytheon and Nightwing (1 May 2025, 8.4 million dollars): DOJ alleged failure to implement required cybersecurity controls and a system security plan on an internal development system used on 29 DoD contracts and subcontracts, citing DFARS 252.204-7012 and FAR 52.204-21. These were allegations resolved by settlement without a determination of liability.
• Reporting failures: not reporting within 72 hours, or not preserving images, is a separate breach from weak controls and is often discovered when DoD learns of an incident from another source.

What it means for AI agents and non-human identities

The clause is about information and systems, so every account, token and tool that can reach CDI is in scope, human or not.

• Service accounts and API tokens on covered systems: NIST SP 800-171 identification and authentication requirements apply to processes acting on behalf of users and to devices. In Revision 3 terms these sit in 03.05.01 User Identification and Authentication and 03.05.02 Device Identification and Authentication. Inventory every service account, CI/CD credential and API key that can read CDI. See the Service Account Security Guide.
• AI tools are external cloud services: if engineers paste controlled technical information into an AI assistant or connect an agent to a CDI repository, that service must meet FedRAMP Moderate equivalent requirements under paragraph (b)(2)(ii)(D) and support reporting, preservation and access. Block unapproved AI use on covered systems. See the FedRAMP Guide.
• Compromised machine credentials are reportable incidents: paragraph (c) requires identifying compromised user accounts; treat stolen tokens, keys and service account credentials the same way, and include them in the 72-hour report.
• Logs for preservation: 90-day preservation is only possible if token issuance, API calls and agent tool calls are logged and retained. See 03.03.01 Event Logging and the Defence Industrial Base Identity Security Guide.
• Medium assurance certificate: the certificate used for DIBNet reporting is itself a high-value credential; store it in a managed vault with named custodians and a backup holder.

Compliance steps

1. Find the CDI. Identify contracts containing 7012, the CDI they involve, and every system, cloud service and supplier that touches it. Consider an enclave to reduce scope.
2. Write or refresh the system security plan. Cover all 110 Revision 2 requirements per covered system, with plans of action and milestones for gaps.
3. Score honestly and post to SPRS. Run the DoD assessment methodology, post the score, and update it when it changes. The MORSECORP case turned on a stale score.
4. Qualify every cloud service. For each external service handling CDI, obtain evidence of FedRAMP Moderate authorisation or equivalence, and contract terms for incident reporting, preservation and access.
5. Obtain the medium assurance certificate and test DIBNet access. Confirm at least two people can submit a report.
6. Build the 72-hour playbook. Discovery criteria, who decides, what goes in the report, review for compromised systems, data and accounts, and the clock starting at discovery. See the Incident Response Plan Template.
7. Prepare preservation. Retain enough logging and packet capture to preserve 90 days from report; agree imaging procedures with your incident response provider. See the Disk Imaging and Forensic Acquisition Guide.
8. Manage subcontractors. Flow the clause down unaltered, require notice of incidents with the DoD report number and of variance requests, and track supplier SPRS status.
9. Prepare for CMMC. Even with Phase 2 reportedly suspended, Level 2 self-assessment and annual affirmations apply where contracts require them.

Framework mapping

Detection and measurement

• Current SPRS score against the internally calculated score, and the date of the last assessment (must be under three years).
• Percentage of external services handling CDI with documented FedRAMP Moderate authorisation or equivalence.
• Time from discovery to DIBNet submission in exercises and real incidents (target: well under 72 hours).
• Covered systems with log and packet capture retention sufficient to preserve 90 days from a report.
• Subcontracts with 7012 flowed down and a supplier incident contact on file.
• Service accounts and tokens with CDI access that have an owner, rotation date and logging.

Common failure patterns

• Commercial email or file sharing without equivalence evidence: the most common cloud gap, and the issue in the MORSECORP settlement.
• Optimistic SPRS scores: a self-assessed score that is never updated after gaps are found creates False Claims Act exposure.
• Clock confusion: waiting for confirmation that CDI was taken before reporting, when the 72 hours runs from discovery of the incident.
• No certificate, no report: discovering during an incident that nobody holds a medium assurance certificate.
• Logs overwritten: default log retention that rolls over before images and captures can be preserved for 90 days.
• Shadow AI and SaaS: engineers using unapproved cloud tools with controlled technical information, putting the contractor outside paragraph (b)(2)(ii)(D) without knowing it.

Practitioner checklist

• List every contract with 7012 and map CDI to systems, services and suppliers.
• Maintain a system security plan covering all 110 Revision 2 requirements with plans of action.
• Post a current, defensible SPRS score and update it when it changes.
• Hold FedRAMP Moderate authorisation or equivalence evidence for every cloud service handling CDI.
• Hold a medium assurance certificate with at least two trained reporters and test DIBNet access.
• Run a 72-hour reporting exercise that includes compromised service accounts and tokens.
• Retain images, logs and packet capture so 90-day preservation is possible.
• Flow 7012 down unaltered and track subcontractor incidents and variance requests.
• Block unapproved AI and SaaS tools on covered systems.
• Check current DoD class deviations and CMMC requirements with the contracting officer each contract cycle.

Standards and references

• Acquisition.gov: DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
• Acquisition.gov: DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
• Federal Register: DFARS Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)
• US Department of Justice: MORSECORP agrees to pay 4.6 million dollars to settle cybersecurity fraud allegations
• US Department of Justice: Raytheon companies and Nightwing Group pay 8.4 million dollars
• Summit 7: DFARS 7012 class deviation
• Elevate: DFARS class deviation 2026-O0025 Revision 3

This guide summarises DFARS 252.204-7012 and related clauses as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: NIST SP 800-171 and CMMC 2.0 Guide · CMMC 2.0 Level 2 Assessment Guide · System Security Plan Template and Guide · CUI Guide · FedRAMP Guide