DFARS Compliance Checklist

DFARS 252.204-7012: The 7 Core Requirements

252.204-7012 breaks down into seven main things you have to actually do. Each one maps to specific NIST 800-171 controls, and each one costs real money to implement.

Requirement 1: CUI Identification and Protection

The requirement: You have to find all your Covered Defense Information (CDI), mark it, and lock it down so nobody unauthorized can see it.

Key NIST 800-171 requirements: 3.1.1 (Authorized Access Control), 3.8.1 (Media Protection), 3.13.1 (Boundary Protection), 3.13.16 (CUI at Rest)

Implementation steps:

• Define what constitutes CUI in your organization (technical data, specifications, source code, design docs, performance data)
• Classify existing systems: which handle CUI, which don't
• Implement data classification labels/markings in your document management system
• Configure access controls to restrict CUI access to authorized personnel only
• Enable encryption for CUI at rest and in transit (AES-256 or equivalent)
• Set up auditing and logging for all CUI access

Estimated cost (50-person contractor): $18,000–$35,000 (software licensing, consultant days, staff training)

Requirement 2: 72-Hour Cyber Incident Reporting

The requirement: Spot a cyber incident involving CUI? You have 72 hours from when you discover it (not when it happened) to report it to DoD. Miss that deadline or don't report it at all? That's an automatic violation.

Key NIST 800-171 requirements: 3.6.1 (Incident Handling), 3.6.2 (Incident Reporting), 3.14.6 (Monitor for Attacks), 3.3.1 (System Auditing)

Implementation steps:

• Deploy SIEM (Security Information and Event Management) tool to detect anomalies and intrusions in real-time
• Create formal incident response procedure document with clear escalation paths
• Define what qualifies as a reportable incident under DFARS (any confirmed breach of CUI confidentiality, availability, or integrity)
• Establish incident response team with assigned roles and 24/7 on-call rotation
• Create template for your DoD incident report (includes system affected, CUI involved, threat actor if known, timeline); reports are filed on the DIBNet portal (dibnet.dod.mil)
• Test incident detection and reporting through quarterly tabletop exercises
• Maintain incident response logs documenting discovery time, investigation timeline, and action items

Estimated cost (50-person contractor): $25,000–$50,000 (SIEM licenses, IR tools, consultant setup, staff training)

Requirement 3: Medium Assurance Certificates

The requirement: To report a cyber incident to DoD under DFARS 252.204-7012, you file on the DIBNet portal (dibnet.dod.mil), and DIBNet requires a DoD-approved Medium Assurance Certificate. That's an identity certificate issued to a person at your company by an approved External Certification Authority (ECA), not a website or TLS certificate. If you don't have one when an incident hits, the 72-hour clock keeps running while you try to get one.

Where it comes from: the cyber incident reporting paragraph of DFARS 252.204-7012. Related NIST 800-171 requirement: 3.6.2 (Track, Document, and Report Incidents)

Implementation steps:

• Decide who will file incident reports (primary and backup) and get each of them a Medium Assurance Certificate from a DoD-approved ECA provider
• Install the certificate and test that you can log in to DIBNet before you need it
• Track certificate expiration dates and renew before they lapse
• Write the certificate holders and the DIBNet process into your incident response plan
• Know the rest of the clause's reporting duties: submit any malicious software you isolate to DoD's Cyber Crime Center (DC3) as instructed, and preserve images of affected systems for at least 90 days

Encrypting CUI in transit (TLS 1.2+, strong certificates) is still required, but that's NIST 800-171 requirement 3.13.8, covered under Requirement 1.

Estimated cost (50-person contractor): $3,000–$8,000 (certificates, infrastructure changes, validation)

Requirement 4: Self-Assessment Against NIST 800-171

The requirement: Under DFARS 252.204-7019/-7020 (which work alongside 7012), you need a current NIST SP 800-171 assessment score posted in SPRS, no more than 3 years old. Most contractors do a Basic (self) assessment; DoD can also run Medium or High assessments. It's basically admitting where you're weak, honestly.

Key NIST 800-171 requirements: 3.12.1 (Security Control Assessment), 3.12.2 (Plans of Action), 3.12.3 (Security Control Monitoring)

Implementation steps:

• Use NIST SP 800-171A's assessment objectives to judge each requirement
• Map your current security controls to each of the 110 NIST 800-171 requirements
• Mark each requirement MET or NOT MET (no partial credit except a few defined cases, such as 3.5.3 MFA and 3.13.11 FIPS-validated encryption)
• Document evidence for each requirement: policies, procedures, screenshots, test results
• Calculate your score with the DoD Assessment Methodology: start at 110 and subtract 5, 3, or 1 points for each requirement not met (lowest possible: -203). For CMMC Level 2, Conditional status needs at least 88 and Final status needs 110
• Identify gaps and create a POA&M with the date you expect to reach 110
• Post the score, assessment date, scope, SSP name, and that date in SPRS through PIEE
• Document findings in System Security Plan (SSP)

Estimated cost (50-person contractor): $8,000–$20,000 (consultant days, internal staff time, documentation)

Requirement 5: System Security Plan (SSP)

The requirement: Write up a detailed System Security Plan that documents all your controls, system boundaries, how data flows, your risks, and how you're handling them. Update it annually.

Key NIST 800-171 requirements: 3.12.4 (System Security Plan), 3.11.1 (Risk Assessment), 3.12.2 (Plans of Action)

Implementation steps:

• Define system boundary: which systems, networks, and applications handle CUI
• Document system architecture diagram (detailed, showing data flows)
• Create risk assessment identifying threats and vulnerabilities
• List all 110 NIST 800-171 controls and how each is implemented
• Document roles and responsibilities (who manages security, who has access)
• Include incident response procedure and recovery time objectives (RTO/RPO)
• Document change management and configuration management processes
• Create Plan of Action & Milestones (POA&M) for any gaps
• Review and update SSP annually or after major system changes

Estimated cost (50-person contractor): $12,000–$25,000 (consultant writing, internal SME time)

Requirement 6: Subcontractor and Supplier Flow-Down (Critical, Often Missed)

The requirement: Every subcontractor or supplier touching CUI has to follow the same DFARS rules you do. You're liable if they screw up. People skip this one, and it costs them later.

Where it comes from: the flow-down paragraph of DFARS 252.204-7012 itself (a contract requirement, not a NIST family). Related NIST 800-171 requirement: 3.1.20 (External Connections)

Implementation steps:

• Audit all subcontractors and vendors: which have access to CUI?
• Add DFARS clause 252.204-7012 to all contracts with CUI access
• Require each subcontractor to provide proof of NIST 800-171 compliance (SSP and SPRS score, or a CMMC certificate if they have one)
• Establish service level agreements (SLAs) defining incident reporting timelines for subs
• Require subs to flow down the same DFARS obligations to their own subs (multiple levels)
• Conduct periodic audits of sub compliance (at least annually)
• Create a central register tracking all subs with CUI access and their compliance status
• Include termination clauses if a sub fails DFARS compliance verification

Estimated cost (50-person contractor with 5–10 active subs): $10,000–$18,000 (legal review, contract updates, audit cycles)

Requirement 7: Cloud Service Provider Controls and Approval

The requirement: Using cloud for CUI? The service has to meet security requirements equivalent to the FedRAMP Moderate baseline, and the provider has to meet 7012's incident reporting, malware, media preservation, and forensic access requirements. A lot of companies miss this and end up with non-compliant cloud setups.

Where it comes from: DFARS 252.204-7012's cloud computing paragraph. Related NIST 800-171 requirements: 3.1.20 (External Connections), 3.13.1 (Boundary Protection)

Implementation steps:

• Audit current cloud usage: which services store or process CUI?
• Check FedRAMP authorization status at fedramp.gov for each service
• If a service isn't FedRAMP Moderate authorized, get documentation that it meets FedRAMP Moderate equivalency (the DoD CIO's December 2023 memo spells out what that requires), or move CUI to an authorized service
• For FedRAMP services: review the authorization letter and confirm your use case is covered
• Implement cloud access controls (IAM policies, VPC isolation, encryption keys in your control)
• Maintain contract addendum documenting cloud security requirements and data retention policies
• For backup/disaster recovery: ensure the backup cloud provider also meets FedRAMP Moderate or equivalent

Common FedRAMP authorized services: AWS GovCloud, Microsoft Azure Government, Google Cloud FedRAMP Moderate (Oracle, Salesforce, ServiceNow also have authorizations)

Estimated cost (50-person contractor): $5,000–$15,000 (if cloud migration needed) or $1,000–$3,000 (if already using FedRAMP services)

DFARS 252.204-7012 to NIST 800-171 Control Mapping

Most of the 7 requirements map to specific NIST 800-171 control families. A few (incident reporting logistics, cloud, flow-down) come straight from the clause itself:

Bottom line: Full implementation of all 110 NIST 800-171 requirements covers the "adequate security" part of DFARS 252.204-7012. You also need the clause's own pieces: 72-hour reporting on DIBNet with a Medium Assurance Certificate, malware submission, 90-day image preservation, compliant cloud, and flow-down. CMMC Level 2 assessment validates the NIST part.

Common DFARS Compliance Gaps

• ✓ Subcontractor oversight missing: Many contractors don't verify sub compliance or flow down requirements, which is a violation of the clause
• ✓ Incident reporting delays: Companies detect incidents but miss the 72-hour DoD reporting window due to unclear procedures
• ✓ Cloud service gaps: Using commercial services (Dropbox, Slack, GitHub) for CUI without FedRAMP Moderate authorization or documented equivalency
• ✓ Weak access controls: CUI systems still use weak authentication (no MFA); unsegregated from public networks
• ✓ No SSP maintained: Security controls exist but are never documented in a formal System Security Plan
• ✓ Outdated self-assessment: Last SPRS score calculated 3+ years ago; no continuous monitoring
• ✓ TLS/cert configuration weak: Legacy systems still using TLS 1.0, SHA-1 certificates, or self-signed certs
• ✓ No Medium Assurance Certificate: Discovering during an incident that you can't log in to DIBNet to file the 72-hour report

Step-by-Step DFARS Compliance Checklist

Cost Estimates by Organization Size

Cost breakdown typical of mid-market (50-person) contractor:

• Security tools (SIEM, EDR, encryption, MFA): $20,000–$30,000/year
• Consultant fees (gap analysis, SSP, CMMC assessment): $35,000–$50,000
• Internal staff time (IT, compliance, security): $15,000–$25,000
• Third-party services (penetration testing, code review): $10,000–$15,000
• Total first-year: $80,000–$120,000
• Annual maintenance: $25,000–$40,000 (tool licenses, staff, annual assessment)

Recommended Tools for DFARS Compliance

These tools help with specific DFARS and NIST 800-171 implementation tasks:

• ✓ SIEM & incident detection: Splunk Enterprise, Microsoft Sentinel, Elastic Stack
• ✓ Vulnerability scanning: Nessus Professional, Qualys VMDR, Rapid7 InsightVM
• ✓ Encryption at rest: HashiCorp Vault, AWS KMS, Microsoft Azure Key Vault
• ✓ Access control & IAM: Okta, Microsoft Entra ID, Ping Identity
• ✓ Endpoint detection & response: CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR
• ✓ SPRS self-assessment: NIST SP 800-171A assessment objectives plus the DoD Assessment Methodology scoring; our free SPRS calculator explains the method
• ✓ Documentation & SSP: Workiva, Drata, Vanta (automated control mapping)

Ready to start your DFARS compliance program? Use our DFARS Compliance Cost Calculator to estimate implementation costs for your organization.

Frequently Asked Questions

Does every DoD contractor need DFARS compliance?

Almost certainly. DFARS 252.204-7012 goes into nearly all DoD contracts (the exception is contracts solely for commercially available off-the-shelf items), and its safeguarding requirements apply to any system that handles covered defense information (CUI).

What's the difference between DFARS compliance and CMMC certification?

DFARS is the legal requirement. CMMC is the verification. You must be DFARS-compliant regardless. Today CMMC Level 2 is met by self-assessment where the clause is in your contract; mandatory C3PAO certification was paused on July 13, 2026 with no new date set, but a voluntary certificate still provides independent proof that you meet the requirements.

Can we use non-FedRAMP cloud services for CUI?

Only if the service meets security requirements equivalent to the FedRAMP Moderate baseline (the DoD CIO's December 2023 memo explains what equivalency requires) and the provider agrees to 7012's incident reporting, malware, media preservation, and forensic access requirements. Otherwise, use a FedRAMP Moderate (or higher) authorized service.

How often do we need to update our System Security Plan?

Annually minimum. Update immediately after major system changes, security incidents, or control modifications.

What happens if we miss the 72-hour incident reporting deadline?

It's a direct DFARS violation. Expect scrutiny from DoD; the contract can be terminated, and debarment is possible.

Are we liable for our subcontractor's DFARS violations?

Yes. You're responsible for verifying sub compliance and flow-down obligations. If a sub violates DFARS and you knew or should have known, you're liable.