What is DFARS?
The Defense Federal Acquisition Regulation Supplement (DFARS) is basically FAR on steroids for DoD contracts. It's the extra layer the Department of Defense added to the baseline Federal Acquisition Regulation to lock down how you handle sensitive defense information. You get additional compliance rules that go way beyond the standard procurement stuff.
Here's the thing: if you're touching DoD networks or managing Controlled Unclassified Information (CUI), DFARS isn't optional—it's a hard contractual requirement. You don't get to choose. Win a DoD contract and suddenly DFARS compliance becomes a legal obligation you can't wiggle out of.
The real centerpiece is clause 252.204-7012, which mandates safeguarding for covered defense information and cyber incident reporting. Sounds bureaucratic, but this single clause is where the modern defense contractor cybersecurity obligations actually live.
Every DoD Contractor Is Affected
If you bid on or hold a DoD contract and handle CUI, DFARS 252.204-7012 compliance is mandatory — not optional.
See Requirements →DFARS 252.204-7012: The Safeguarding Clause
So 252.204-7012 is where it all gets real. The clause requires you to put in place "adequate security measures" for Covered Defense Information (CDI)—basically any unclassified technical data or info that's marked as sensitive or that any reasonable person would know needs protection from getting leaked.
Breaking it down, the clause really comes down to seven things you need to actually do:
- Identification and protection of CUI: Contractors must identify all covered defense information and apply appropriate protections
- Cyber incident reporting: Any cybersecurity event involving CUI must be reported to DoD within 72 hours of discovery
- Security assessment: Organizations must conduct self-assessments of compliance with NIST SP 800-171
- System security planning: Document security controls in a System Security Plan (SSP)
- Incident response capability: Establish procedures to detect, investigate, and respond to cyber incidents
- Flow-down requirements: Pass DFARS obligations to all subcontractors and suppliers with access to CUI
- Cloud service provider approval: Any cloud services processing CUI must be approved by DoD or meet FedRAMP Moderate equivalency
How DFARS Relates to CMMC and NIST 800-171
These three frameworks stack on top of each other in a pretty logical way:
- DFARS 252.204-7012 creates the legal requirement for security controls (the mandate)
- NIST SP 800-171 provides the specific 110 security controls contractors must implement (the blueprint)
- CMMC verifies that DFARS and NIST 800-171 controls are properly implemented (the proof): by self-assessment today, with third-party C3PAO certification paused since July 2026 but likely to return in some form
Here's the thing: DFARS doesn't tell you how to actually build security. It just says you need it. That's where NIST 800-171 steps in. It's become the industry standard for "adequate security" and Revision 2, the version DFARS 7012 and CMMC use today, maps out 110 specific requirements across 14 families. CMMC Level 2 assessment covers all 110 of them.
Bottom line: DFARS says you need security controls. NIST 800-171 tells you which ones. CMMC Level 2 proves you actually did it.
DFARS Compliance Requirements Checklist
| Requirement | Explanation | Verification Method |
|---|---|---|
| CUI Identification & Classification | Mark and track all covered defense information within your systems | Document review; DoD (DIBCAC) assessment |
| NIST 800-171 Controls Implementation | Implement the 110 security requirements of NIST SP 800-171 Rev 2 (Level 2 = 110 controls) | CMMC assessment, self-assessment SPRS |
| Cyber Incident Reporting (72 hours) | Report security incidents involving CUI to DoD within 72 hours of discovery | Incident response documentation |
| Medium Assurance Certificate (for incident reporting) | Obtain a DoD-approved Medium Assurance Certificate, an identity certificate from an approved External Certification Authority (ECA), so you can file cyber incident reports on the DoD's DIBNet portal | Certificate on hand and tested before an incident; incident response plan |
| Subcontractor Flow-Down | Impose identical DFARS/NIST 800-171 requirements on all suppliers with CDI access | Contract review, subcontractor assessment results |
| Cloud Service Provider Controls | Cloud services storing or processing CUI must meet the FedRAMP Moderate baseline or its equivalent, and the provider must meet 7012's incident reporting and forensic requirements | FedRAMP authorization or equivalency documentation, provider contract terms |
| Personnel Security Screening | Conduct background checks on all personnel with CUI access | Security clearance verification, vetting records |
| System Security Plan | Document all security controls, system boundaries, and risk mitigations | CMMC assessor review, SPRS submission |
DFARS vs. FAR: Key Differences
FAR is the baseline playbook that applies to pretty much any federal contract. It covers the basics: how you form contracts, pricing, property handling, general compliance stuff.
DFARS is what you get when the DoD says "we need more" on top of FAR. It adds stricter cybersecurity and supply chain risk rules. Here's how they really differ:
- Cybersecurity specificity: DFARS mandates NIST 800-171; FAR is cybersecurity-agnostic
- CUI handling: DFARS has detailed unclassified information protection rules; FAR does not
- Incident reporting: DFARS requires 72-hour DoD incident reporting; FAR has no such requirement
- Supply chain risk: DFARS requires "critical cybersecurity supply chain risk management" language; FAR has no equivalent
- Subcontractor flow-down: DFARS clauses must flow down to all subcontractors; FAR is less prescriptive
- Enforcement: DFARS violations can trigger contract termination and debarment; FAR violations are typically administrative
Timeline and Current Enforcement Status
The 252.204-7012 clause dropped back in December 2016, and the 72-hour incident reporting requirement kicked in right away. It originally referenced NIST 800-171 Rev 1.
Today, DFARS 7012 and CMMC Level 2 assess against NIST SP 800-171 Revision 2 (110 requirements). NIST published Revision 3 in 2024, but DoD hasn't made it the contract standard yet.
CMMC Phase 1 began November 10, 2025, putting Level 1 and Level 2 self-assessments into solicitations. Phase 2, the move to mandatory C3PAO certification originally set for November 10, 2026, was suspended on July 13, 2026 along with the later phases while a CMMC Reform Task Force reviews the program. No new date has been set.
Where we are now (October 2026):
- DFARS 252.204-7012 safeguarding and 72-hour incident reporting to DoD still apply to every contract that includes the clause
- DFARS 252.204-7019/7020 still require a current SPRS score, and DoD can still conduct Medium and High assessments
- Contracting officers are using only CMMC Level 1 (Self) or Level 2 (Self) requirements; C3PAO certification is currently voluntary, though some primes still ask suppliers for it
- False Claims Act enforcement continues: in September 2026, Honeywell Aerospace settled for about $2.04 million over NIST 800-171 non-compliance
- A proposed FAR CUI rule (June 2026) would extend CUI safeguarding to civilian-agency contractors and reference NIST 800-171 Rev 3. It's proposed only, not final
The rollout schedule is paused. The obligations aren't.
Penalties for Non-Compliance
Let's be clear: screwing this up is expensive. Here's what happens if you don't comply:
- Contract termination: DoD can terminate contracts immediately upon discovering non-compliance, with no recourse
- False Claims Act liability: If a contractor certifies DFARS compliance falsely, the False Claims Act applies. Civil penalties per false claim (adjusted annually for inflation), plus treble damages (3x the loss to the government). Recent settlements include Honeywell Aerospace (~$2.04M, 2026), MORSECORP ($4.6M, 2025) and Georgia Tech ($875K, 2025)
- Criminal liability: Executives responsible for knowingly false certifications can face criminal prosecution
- Debarment: Contractors can be debarred from federal business
- Contract suspension: Immediate suspension pending debarment investigation
- Loss of future contracts: Even resolved violations appear on your Federal Awardee Performance and Integrity Information System (FAPIIS) record, affecting future contract bids
One late or missed incident report? That's an automatic compliance violation. A cyber incident you didn't catch fast enough? Expect DoD to ask questions.
How to Get DFARS Compliant
Getting DFARS-compliant isn't a one-and-done project. It's a process with phases:
- Gap analysis: Conduct a self-assessment against all 110 NIST 800-171 controls (use NIST SP 800-171 Revision 2, the version DFARS 7012 and CMMC assess against today)
- System boundary definition: Identify all systems and data flows handling CUI; separate CUI systems from public-facing systems
- Control implementation: Prioritize high-risk, easy-to-implement controls first (access control, encryption, incident response)
- System Security Plan: Document all controls and their implementation in a formal SSP
- Self-assessment scoring: Calculate your SPRS score with the DoD Assessment Methodology (start at 110 and subtract 5, 3, or 1 points for each requirement not implemented) and post it in SPRS through PIEE
- Remediation planning: Create a Plan of Action & Milestones (POA&M) for remaining gaps
- CMMC assessment: Post your Level 2 self-assessment in SPRS. Consider a voluntary C3PAO (Certified Third-Party Assessor Organization) assessment if your primes ask for one; it's also strong evidence if the certification requirement returns
- Incident response testing: Conduct tabletop exercises and penetration tests to validate incident detection and reporting
Start Your Compliance Journey
Our free readiness assessment benchmarks your current NIST 800-171 score and identifies your highest-priority gaps.
Free Assessment →Want to know where you actually stand? Our DFARS Readiness Assessment benchmarks you against the 110 NIST 800-171 controls and shows you how you compare to others in your industry.
Key Resources and Next Steps
- DFARS 252.204-7012 Detailed Compliance Checklist — Step-by-step implementation guide with cost estimates
- CMMC Certification Overview — Understanding CMMC Level 2 and the assessment process
- DFARS Compliance Cost Calculator — Estimate implementation costs by company size and current control maturity
Disclosure: Defense Compliance.ai contains affiliate links to compliance software and assessment tools. We recommend tools we've independently vetted; affiliate commissions help fund this resource.