What DFARS 252.204-7012 Actually Obligates You to Do, Clause by Clause

Paragraph (b) requires adequate security on every covered contractor information system. The clause defines adequate security as protective measures proportionate to the consequences and likelihood of loss, misuse, unauthorized access or modification of the information.

For your own systems, paragraph (b)(2) is the core requirement for nearly every contractor: implement the security requirements in NIST SP 800-171. The 2026-07-13 implementing memo on the CMMC Phase 2 suspension says the Department will enforce baseline compliance with NIST SP 800-171 Rev 2. If a requirement does not apply to your environment, or you meet it another way, you can submit a written request for a variance to your contracting officer, and the DoD CIO decides on it.

If a cloud service provider stores, processes or transmits your CDI, paragraph (b)(2)(ii)(D) requires you to require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also support the incident reporting, malware, media preservation, access and damage assessment duties in paragraphs (c) through (g). Ask your provider for its assessment documentation in writing, because "aligned with FedRAMP" is not the same as equivalent.

There is a practical consequence here. NIST SP 800-171 itself expects a system security plan, and plans of action for any requirements you have not yet met. If you have never written those documents, you have not met paragraph (b).

Paragraph (e) covers media preservation and protection. Keep images of all known affected information systems identified in your review, along with all relevant monitoring and packet capture data, for at least 90 days from the date you submit the incident report. If you do not capture system images or keep network monitoring data today, you cannot meet this requirement after the fact.

Paragraph (f) requires you to provide access to additional information or equipment when DoD asks for it for forensic analysis. Under paragraph (g), if DoD decides to assess the damage, the contracting officer will ask for the damage assessment information you preserved under (e).

Paragraphs (h) through (l) mostly limit what the government can do with your information and clarify how the clause fits with other rules. Paragraph (h) asks you to identify and mark your attributional or proprietary information as far as practicable, so do it when you submit, not afterward. Paragraph (l) says the clause does not replace any other safeguarding or reporting duty you have, so a state breach law or a separate federal requirement still applies.

These are separate clauses. DFARS 252.204-7012 creates the obligations: implement NIST SP 800-171, report incidents, preserve evidence, flow down. DFARS 252.204-7019 and 252.204-7020 require a current NIST SP 800-171 DoD Assessment, which is the score you post in SPRS, and give DoD the right to assess you. DFARS 252.204-7021 is the CMMC clause, which requires the CMMC status the contract specifies.

CMMC checks whether you have done what 7012 already required. The 2026-07-13 implementing memo suspended the November 2026 transition to CMMC Phase 2, and says the requirements of DFARS 252.204-7012 remain in effect. See our article on whether CMMC Phase 2 is paused for what the memo changed.

If you post a self-assessment score that overstates your implementation, the problem is more than a weak score. The Department of Justice's Civil Cyber-Fraud Initiative, announced in 2021, has used the False Claims Act against contractors that misrepresented their cybersecurity compliance. Whether or not you are certified, the safest position is the same: implement what you say you have implemented, and make sure your documents match how your systems actually run.