DFARS 7012, 7019, 7020, 7021: Contractor Cheat Sheet
You just got a contract with one or more of these DFARS clauses. Here’s what each requires and what to do first.
Last updated: October 2026
DFARS 252.204-7012, 7019, 7020, and 7021 are the four cybersecurity clauses that show up most in defense contracts. 7012 sets the security rules for CUI. 7019 and 7020 require a scored NIST SP 800-171 assessment in SPRS and give the government the right to check it. 7021 makes CMMC status a condition of award. Use this cheat sheet to see what each one asks of you and what to do in your first 30 days.
DFARS clauses at a glance
| Clause | Full name | What it requires | Who it applies to | Immediate action | Related CMMC/NIST item |
|---|---|---|---|---|---|
| 252.204-7012 | Safeguarding Covered Defense Information and Cyber Incident Reporting | Protect CUI with NIST SP 800-171 controls, use FedRAMP Moderate (or equivalent) cloud for CUI, report cyber incidents within 72 hours, preserve images for 90 days | Contractors and subs that process, store, or transmit CUI | Find where CUI lives, confirm your cloud services, and set up DIBNet reporting | NIST SP 800-171 Rev 2 (110 controls); CMMC Level 2 |
| 252.204-7019 | Notice of NIST SP 800-171 DoD Assessment Requirements | A current NIST SP 800-171 assessment score posted in SPRS, no more than 3 years old, at the time of award | Offerors on contracts that include 7012 | Check SPRS for a current score for each CAGE code | SPRS score (max 110); CMMC Level 2 self-assessment |
| 252.204-7020 | NIST SP 800-171 DoD Assessment Requirements | Give DoD access for Medium or High assessments, keep your SPRS score current, and confirm subs have scores before flowing down CUI | Contractors and subs subject to 7012 | Make sure your SSP and evidence are ready for a DIBCAC review | DIBCAC Medium/High assessment; SSP and POA&M |
| 252.204-7021 | Contractor Compliance with the CMMC Level Requirement | Hold the required CMMC status in SPRS at award, affirm compliance annually, and flow the requirement down to subs handling FCI or CUI | Contractors and subs handling FCI or CUI on contracts with a CMMC requirement | Confirm the CMMC level in your contract and your status in SPRS | CMMC Level 1, 2, or 3; annual affirmation |
Scroll the table sideways on a phone to see every column.
DFARS 252.204-7012: safeguarding CUI and reporting incidents
7012 is the foundation. If your contract involves Controlled Unclassified Information (CUI), it almost certainly includes this clause, and every other clause on this page builds on it.
What 7012 requires
- NIST SP 800-171 controls. Implement the 110 security requirements in NIST SP 800-171 Rev 2 on every system that processes, stores, or transmits CUI. Document them in a System Security Plan (SSP) and track gaps in a Plan of Action and Milestones (POA&M).
- Cloud services at FedRAMP Moderate or equivalent. Any cloud service that stores or processes CUI must meet the FedRAMP Moderate baseline or an equivalent, and the provider must also follow 7012’s incident reporting and media rules. In practice, that is why most contractors use Microsoft 365 GCC High, Azure Government, or AWS GovCloud.
- 72-hour incident reporting. Report cyber incidents that affect CUI or your ability to perform operationally critical support to DoD within 72 hours of discovery at dibnet.dod.mil. You need a DoD-approved medium assurance certificate to submit, so get one before you need it.
- Media preservation. Keep images of affected systems and relevant monitoring and packet capture data for at least 90 days after you report, in case DoD asks for them.
- Malicious software. Submit any malicious software you isolate to the DoD Cyber Crime Center (DC3) as instructed.
- Flow-down. Include 7012 in subcontracts where the sub handles CUI or provides operationally critical support. Subs report incidents to DoD and also tell you, the prime.
Not sure which systems count as handling CUI? Start with CMMC scoping explained: what counts as in scope. Choosing a compliant Microsoft environment? See GCC High vs GCC vs Commercial Microsoft 365.
DFARS 252.204-7019: your SPRS score at offer
7019 is a notice clause that appears in solicitations. It tells you that you cannot be considered for award without a current NIST SP 800-171 assessment on file.
- Score in SPRS at offer. You need at least a Basic (self) assessment score posted in the Supplier Performance Risk System (SPRS) for each covered information system, tied to your CAGE code.
- Three-year currency. The assessment must be no more than three years old at the time of award.
- Missing score means no award. If the contracting officer cannot find a current score, your offer can be ruled ineligible. This is one of the most avoidable ways to lose a contract.
Scores run from 110 (every control met) down to negative numbers. A low score does not disqualify you on its own under 7019, but primes and contracting officers look at it, and CMMC Level 2 sets a minimum of 88 to qualify with open POA&M items.
DFARS 252.204-7020: DoD’s right to check your work
7020 puts the assessment requirement into the contract itself and gives DoD the right to verify what you reported.
- DIBCAC access. You must give the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) access to your facilities, systems, and people for a Medium or High assessment.
- Government results override self-scores. If DIBCAC assesses you, its score replaces your self-assessed score in SPRS. Overstated self-scores tend to surface here.
- Subs need scores too. Before you flow down 7012 to a subcontractor, confirm the sub has a current assessment score in SPRS.
Recent DoD class deviations have renumbered some CMMC-related clauses in new solicitations. If your contract cites a different number for the assessment clause, check with your contracting officer which version applies. The obligations are the same in substance.
DFARS 252.204-7021: CMMC as a condition of award
7021 took effect November 10, 2025. It turns your CMMC status into a gate: if the contract requires a level, you need that status on file before award.
- CMMC status at award. Your required CMMC level (Level 1 self, Level 2 self, Level 2 C3PAO, or Level 3) must be current in SPRS for each information system that will handle FCI or CUI.
- Annual affirmation. A senior official must affirm continuing compliance in SPRS every year, and again after any assessment.
- Report changes. Tell the contracting officer within 72 hours of any lapse in information security or change in your CMMC status during the contract.
- Flow-down. Subs that process, store, or transmit FCI or CUI must hold the CMMC level that fits the information they handle. Primes are responsible for checking.
The July 2026 Phase 2 suspension
On July 13, 2026, the Department of War suspended CMMC Phase 2, which was set to start November 10, 2026. New contracts are not requiring third-party (C3PAO) certification while a reform task force reviews the program.
The rest still applies. DFARS 7012, NIST SP 800-171, Level 1 and Level 2 self-assessments, SPRS scores, and annual affirmations all remain in force. Primes can still require certification from their subs before sharing CUI, and many do. Read your contract and any flow-down terms carefully.
How the clauses work together
Think of the four clauses as layers. Each one adds a check on top of the one below it.
- 7012 sets the rules. Protect CUI with NIST SP 800-171 and report incidents.
- 7019 asks for your score. Show your self-assessment in SPRS before award.
- 7020 lets DoD verify. The government can assess you, and its score wins.
- 7021 makes it a gate. No current CMMC status, no award, and you must affirm it every year.
Because they stack, a weakness in the bottom layer shows up everywhere. A poorly scoped environment produces a score you cannot defend, an assessment that goes badly, and an affirmation your leadership should not sign. Get 7012 right and the others get much easier.
Your first 30 days: a checklist
Use this as a working plan the week a contract with these clauses lands. Timing will vary with your size and starting point.
| When | Action | Clause |
|---|---|---|
| Days 1 to 5 | Read the contract and list every DFARS and FAR cybersecurity clause, the required CMMC level, and any prime flow-down terms | All |
| Days 1 to 5 | Check SPRS for a current NIST SP 800-171 score and CMMC status for every CAGE code on the contract | 7019, 7021 |
| Days 1 to 10 | Identify what CUI or FCI you will receive, who touches it, and which systems store or process it | 7012, 7021 |
| Days 5 to 10 | Confirm every cloud service that holds CUI meets FedRAMP Moderate or equivalent and accepts 7012 terms | 7012 |
| Days 5 to 15 | Get a DoD-approved medium assurance certificate and test access to DIBNet | 7012 |
| Days 10 to 20 | Update your SSP and POA&M to match the real environment, and recheck your score | 7012, 7020 |
| Days 10 to 20 | Write or refresh your incident response plan with named owners and the 72-hour clock | 7012 |
| Days 15 to 25 | Confirm logging, backups, and imaging can preserve evidence for 90 days | 7012 |
| Days 20 to 30 | Flow down the right clauses to subs and confirm their SPRS scores and CMMC status | 7012, 7020, 7021 |
| Day 30 | Brief leadership on status and gaps before anyone signs an annual affirmation | 7021 |
72-hour incident reporting: who does what
The 72-hour clock starts when you discover the incident, not when you finish investigating it. Decide who owns each step before anything happens. Here is a simple RACI to adapt.
| Task | Contractor incident owner | MSP / SOC | Leadership / Legal | Prime or contracting officer |
|---|---|---|---|---|
| Detect and triage the event | A | R | I | – |
| Decide whether CUI or operationally critical support is affected | A | C | C | – |
| Contain the incident and isolate systems | A | R | I | – |
| Capture system images and preserve logs for 90 days | A | R | I | – |
| Submit the report on DIBNet within 72 hours | R/A | C | C | I |
| Notify the prime (if you are a sub) | R/A | C | C | I |
| Submit malicious software to DC3 | A | R | I | – |
| Approve outside communications and legal notices | C | I | R/A | – |
| Support DoD follow-up and damage assessment requests | R/A | R | C | C |
| Run a lessons-learned review and update the SSP and POA&M | A | R | C | – |
R = Responsible, A = Accountable, C = Consulted, I = Informed.
What your MSP must be able to support
If a managed service provider runs or monitors systems in your CUI environment, its contract and capabilities need to back up your 7012 obligations. Make sure your MSP can:
- Monitor your CUI environment around the clock and escalate to your incident owner fast
- Collect and retain the logs, images, and packet capture data you need for 90 days
- Isolate affected systems without destroying evidence
- Help you assemble the details DIBNet asks for
- Package malicious software for submission to DC3
- Work inside a FedRAMP Moderate or equivalent environment such as GCC High, Azure Government, or AWS GovCloud
- Show its own security practices, since an MSP with access to your CUI environment is part of your assessment scope
Running workloads in the cloud? Our guides on AWS GovCloud for defense contractors and Azure Government vs AWS GovCloud cover what each platform gives you for logging and evidence. Moving email and files? See migrating commercial Microsoft 365 to GCC High.
Common gaps found in prime reviews and assessments
These are the issues that come up most often when primes review suppliers or assessors look at an environment.
| Gap | What it looks like | How to fix it |
|---|---|---|
| No score, or an expired one | The SPRS score is missing, over three years old, or tied to the wrong CAGE code | Post a current score for every CAGE code and set a reminder well before it turns three |
| A score the evidence does not support | The self-assessment claims controls that are not implemented or not documented | Rescore against real evidence and correct SPRS if needed |
| CUI outside the boundary | CUI sits in commercial Microsoft 365, personal email, or a file-sharing tool that does not meet FedRAMP Moderate or equivalent | Move CUI into a compliant environment and block the old paths |
| An SSP that does not match reality | The plan describes an environment that has changed, or was never built that way | Update the SSP whenever the environment changes, and review it at least once a year |
| No DIBNet readiness | No medium assurance certificate, no named incident owner, and no tested plan to meet the 72-hour deadline | Get the certificate, name an owner, and run a tabletop exercise |
| Logs that do not last | Logging is off, incomplete, or kept for less than 90 days | Turn on logging for in-scope systems and set retention to at least 90 days |
| Weak multifactor authentication | MFA is missing for remote, privileged, or network access to CUI systems | Require MFA for every account that can reach CUI |
| Stale POA&M items | Open items have no owner, no date, or have sat untouched for months | Give each item an owner and a due date, and review the list monthly |
| Missing flow-down | Subs received CUI without the right clauses or without a check of their SPRS score and CMMC status | Check subs in SPRS and add the clauses before sharing CUI |
| Affirmations signed without review | Leadership affirmed compliance without a current look at the environment, which creates real legal exposure | Brief leadership on current status and gaps before every affirmation |
Get help with your DFARS obligations
VSO helps defense contractors scope their CUI environment, close NIST SP 800-171 gaps, build compliant cloud environments, and get ready for incident reporting. We scope exactly what you ask for, whether you want us to run the environment or build it right and hand it back to your team. Learn more about our CMMC services, call (888) 805-0510, email sales@vso-inc.com, or talk to us about your contract.
Official sources: DFARS Part 252 on Acquisition.gov and DoD CIO CMMC program.
This cheat sheet is general guidance, not legal advice. Always check the clauses and any class deviations in your specific contract.
