DFARS 252.204-7012: the clause that survived the pause.

DFARS 252.204-7012 appears in DoD solicitations and contracts wherever covered defense information will be processed, stored or transmitted on a contractor system. It is the mechanism by which a NIST publication becomes something you can be held to commercially, and it does four things at once.

1. Adequate security. You must provide it, and the clause defines it as implementing NIST SP 800-171 — all 110 requirements. This obligation has run since 31 December 2017. It is not new, it is not CMMC, and it does not wait for a certification program to tell you when to start.

2. Rapid incident reporting. Cyber incidents affecting covered defense information, or the contractor’s ability to perform operationally critical support, must be reported to the Department within 72 hours of discovery, through dibnet.dod.mil.

3. Preservation and cooperation. You must preserve and protect images of affected systems for at least 90 days from the report, submit malicious software if you find it, and give the Department access to information and equipment necessary for forensic analysis and damage assessment.

4. Flow-down. The clause must be included in subcontracts for operationally critical support, or where subcontract performance will involve covered defense information — without alteration except to identify the parties.

The clock starts at discovery, not at confirmation, and 72 hours is not enough time to establish what happened. That is by design — the report is a notification, not a conclusion, and it can be updated. Organizations that miss the window usually do so not because they were still investigating, but because of the mechanics.

Reporting through DIBNet requires a DoD-approved medium assurance certificate. That is not something to discover you need on day one of an incident: obtaining one takes time, involves a person who may be on leave, and cannot be rushed in the middle of a response. Get it in advance, make sure more than one person can use it, and put the details in the incident response plan rather than in someone’s memory.

Two more preparations pay for themselves. Decide in advance who has the authority to declare that the threshold is met — ambiguity there is where days go. And reconcile the 72-hour duty with your other reporting clocks: state breach laws, the SEC’s disclosure rules if you are a public company, and whatever your prime contract adds on top. They are not the same deadline, and they are not the same audience.

If you use an external cloud service provider to store, process or transmit covered defense information, the clause requires you to ensure that provider meets security requirements equivalent to the FedRAMP Moderate baseline, and that it complies with the incident reporting, malicious software submission, media preservation, forensic access and damage assessment paragraphs of the clause.

The word doing the work is equivalent. A provider holding an actual FedRAMP Moderate authorization is straightforward. A provider claiming equivalence is a document review — and the responsibility for that judgment is yours, not theirs. Where a service holds no authorization and offers no assessment against the baseline, the honest answer is usually that covered defense information should not be in it.

This is worth auditing directly, because it is the requirement most likely to be failed by accident. Covered defense information reaches file-sharing tools, e-signature platforms, project trackers and email systems that nobody thinks of as “the CUI system”. Each of those is an external service provider inside your boundary.

The clause flows down without alteration to any subcontractor whose performance involves covered defense information, at every tier. CMMC adds a verification layer on top: primes must ensure a subcontractor holds the required status before award, and that it affirms continued compliance annually. Where the subcontractor will handle only Federal Contract Information, Level 1 (Self) is the requirement; where CUI is involved and the prime contract carries a Level 3 requirement, the minimum for the subcontractor is Level 2 with a C3PAO certification.

Read that carefully and the structural problem is plain. You are accountable for security controls operating inside companies you have no contractual right to audit, whose evidence reaches you as a self-attestation, refreshed annually at best. In between, their environment changes — new remote access, a migration that exposes a service, an expired certificate, an acquisition that merges two networks with different standards. None of that is reported to you. All of it is your exposure.

The failures that matter here are not exotic. A supplier stands up a remote desktop gateway during a busy month and leaves it exposed. A test environment holding real drawings gets published to the internet. A domain lapses and is re-registered by someone else. Every one of those is visible from outside, on the day it happens, to anyone looking — and nobody is looking, because the process asks a question once a year.

That gap is what continuous external monitoring closes. It does not replace the attestation, which is contractually required, and it does not require the supplier’s cooperation. Supplier risk management covers how the rating works, and supply chain risk covers the wider chain, including the fourth parties you never contracted with.