Terms / The contract
DFARS 252.204-7012
The contract clause that put NIST SP 800-171 on your systems and requires you to report a cyber incident to DoD within 72 hours.
Also called 7012, DFARS 7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.
Official Source Material
Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/sp800) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.
Source: 48 CFR 252.204-7012(b)(2)(i), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
This clause made NIST SP 800-171 your obligation years before CMMC existed.
DFARS 252.204-7012 has appeared in DoD contracts since 2015, and it required you to implement NIST SP 800-171 no later than December 31, 2017. NIST SP 800-171 is the standard that holds the 110 security requirements behind CMMC Level 2. CMMC did not create this duty. CMMC verifies it. If 7012 is in a contract you are performing today, you are already required to meet the standard, whether or not anyone has assessed you.
Covered defense information is this clause's name for what you protect.
The clause covers unclassified controlled technical information and other information listed in the CUI Registry that a law, regulation, or Governmentwide policy requires you to safeguard. That is Controlled Unclassified Information under an older label. The information counts two ways: DoD marked it and gave it to you, or you created it while performing the contract. The second way catches most small companies by surprise.
You report a cyber incident to DoD within 72 hours of discovering it.
The clause defines rapidly report as within 72 hours, and the report goes to dibnet.dod.mil. Reporting there needs a DoD-approved medium assurance certificate, which takes weeks to obtain. Get that certificate before you need it. You also review your systems for evidence that covered defense information was compromised. You then preserve images of the affected systems for at least 90 days after you submit the report. IR.L2-3.6.2 is the internal requirement that makes this reporting path work.
A cloud service that holds covered defense information must clear the FedRAMP Moderate bar.
Paragraph (b)(2)(ii)(D) requires your cloud provider to meet security requirements equivalent to the Federal Risk and Authorization Management Program Moderate baseline. It also requires that provider to follow the clause on incident reporting, media preservation, and forensic access. Ask for the authorization or the written equivalency evidence before you move any data. A sales page that says "DoD ready" is not evidence.
The clause carries flow-down obligations to your subcontracts without alteration.
Paragraph (m) requires you to include the whole clause in any subcontract whose performance will involve covered defense information, including subcontracts for commercial products and services. You decide whether the information you pass down keeps that character, and you consult the contracting officer when you cannot tell. Your subcontractor reports its own incidents to DoD and gives you the incident report number.
What falls short
- A plan to start NIST SP 800-171 once CMMC reaches your contract. The clause set a deadline of December 31, 2017 and stands on its own, so a gap today is a gap against a requirement you already accepted.
- An incident response plan that names no path to DoD. The clause requires the report at dibnet.dod.mil within 72 hours of discovery, and a plan that stops at your IT provider does not meet it.
- A cloud provider chosen on a marketing claim. The clause asks for security equivalent to FedRAMP Moderate, so you keep the provider's authorization letter or its written equivalency statement in your evidence.
Edge cases
- You hold only Federal Contract Information and 7012 still appears in your contract. Ask the contracting officer in writing what covered defense information the contract involves. Contracting offices include the clause by default, and the answer belongs in your file either way.
- A requirement genuinely does not apply to your system. Paragraph (b)(2)(ii)(B) lets you submit a written request to vary, which the contracting officer refers to the DoD Chief Information Officer. Keep any approval, because you provide a copy when you want it recognized on a later contract.
- You discover an incident that touched no covered defense information. You still conduct the review the clause requires, and you record what you found. The review is the obligation, not only the report.
Over-engineering
- A DIBNet report for every phishing message your filter blocked. The clause turns on a cyber incident that affects a covered contractor information system or the information in it, and a message that reached no one is neither.
- A separate incident response contract for a five-person company. A named person, a written procedure, and a tested path to dibnet.dod.mil satisfy the clause and IR.L2-3.6.1.