Clauses · DFARS · Cybersecurity · provision
DFARS 252.204-7008 Compliance With Safeguarding Covered Defense Information Controls
Does the regulation require it to flow down?
No
No mandate exists: 252.204-7008 is a provision with no subcontracts paragraph, and 240.370-5(a)/204.7304(a) prescribe it for solicitations only. Primes flow it down anyway for two reasons — it is on the DFARS 212.301(f) commercial index so it appears in the same generated list as the clauses (7/43 corpus documents carry it, including BAE's USGOVA flow-down and all three GDMS SCM templates), and because CACI's subcontract converts it into a running obligation: 'If Seller is not compliant with the full scope of DFARS 252.204-7008 or 252.204-7012 ... Seller shall notify Buyer immediately'. The real safeguarding duty flows down through 252.204-7012(m), not through this provision
A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.
Checked against acquisition.gov on 2026-08-05 · edition OCT 2016 · base v0.9.3 Read the text ↗
What it makes you produce
2 items for your checklist, slowest first.
Something you write
Days to weeks, and nobody outside your company has to agree to it.
- 252.204-7008(c)(2)(i)
A written explanation for any one of those requirements not met — why it does not reach your systems, or what alternative measure achieves equivalent protection
Owed when you propose to vary from a requirement rather than implement it
Something you fill in and send back
Hours, once you know which one is missing.
- 252.204-7008(c)(1)
The representation, made by submitting the offer itself, that the NIST SP 800-171 security requirements in effect when the solicitation was issued are in place on the systems supporting the work
Owed when the systems supporting the work are your own — (c) reaches only systems that are not an information technology service or system operated on the Government's behalf
When it is used
Solicitation provision. Goes in ALL DoD solicitations, including those using FAR part 12 procedures for commercial products and commercial services, except solicitations solely for the acquisition of COTS items (204.7304(a); re-prescribed at 240.370-5(a) by DoD Class Deviation 2026-O0025, effective 2026-02-01). No dollar threshold. Its substance bites only where covered defense information sits on a covered contractor information system that is not operated on the Government's behalf (paragraph (c)).
Read closely
There is nothing to sign: paragraph (c)(1) makes the offer the representation. A variance is adjudicated in writing by a DoD Chief Information Officer representative before award, and anything accepted is written into the resulting contract. The safeguarding work itself is 252.204-7012's, and the two documents share their definitions.
The 4 templates that name it, with the line
Source: acquisition.gov, DFARS 252.204-7008, DFARS 204.7304(a) and DFARS 212.301(f); DoD Class Deviation 2026-O0025 (acquisition.gov, DoD_RFO_Deviation_Part-40.pdf), DFARS 240.370-5(a) and provision text at Attachment A1 (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.