whatbindsCheck your order

Clauses · DFARS · Cybersecurity

DFARS 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information

Does the regulation require it to flow down?

Yes

(c): subcontracts (or similar instruments) for services that include support for government activities related to safeguarding covered defense information and cyber incident reporting, 'including subcontracts for commercial items'

Form
verbatim — 'without alteration, except to identify the parties', including paragraph (c) itself
Reaches
all tiers

Checked against acquisition.gov on 2026-08-04 · edition JAN 2023 · base v0.9.3 Read the text ↗

What it makes you produce

One item for your checklist.

  1. Something you write

    Days to weeks, and nobody outside your company has to agree to it.

    • Written use and nondisclosure obligations covering your own employees, in place before any of them sees another contractor's cyber incident information

      Owed when an employee is to be given access to, or use of, information that came out of a third party's incident report

      252.204-7009(b)(3)

When it is used

Prescribed at 204.7304(b) for contracts (including FAR Part 12) for services that include support for government activities related to safeguarding covered defense information and cyber incident reporting. Flows down via (c) to subs for those same services, including commercial items.

Read closely

The rest of the clause is restriction rather than paperwork: information from a third party's incident report may be used only to advise or assist the Government ((b)(1)), and the contractor that reported it is a third-party beneficiary of the nondisclosure obligation ((b)(4)).

The 16 templates that name it, with the line
76CORPDOC 2A — FAR/DFARS Flowdown Provisions for Commercial Products/Services under a DoD Prime ContractLockheed Martinline 239143CORPDOC 3A — FAR/DFARS Flowdown Provisions for Fixed Price Non-Commercial Items under a DoD Prime ContractLockheed Martinline 341155CORPDOC 4A — FAR/DFARS Flowdown Provisions for Cost-Reimbursement/T&M Subcontracts under a DoD Prime ContractLockheed Martinline 377233RTX Flowdown of U.S. Government Contract Clauses Under U.S. Government ContractsRTXline 1616166Northrop Grumman CTM-P-ST-001 — U.S. Government Firm Fixed Price Order (Not for Commercial Products and Services)Northrop Grummanline 239369Northrop Grumman CTM-P-ST-002 — U.S. Government FFP or T&M Order for Commercial Products and ServicesNorthrop Grummanline 2385166Northrop Grumman CTM-P-ST-003 — U.S. Government T&M Order (Not for Commercial Products and Services)Northrop Grummanline 2333168Northrop Grumman CTM-P-ST-004 — U.S. Government Cost Reimbursement Order (Not for Commercial Products and Services)Northrop Grummanline 2432255GD Mission Systems SCM-TMP-005 — General Provisions, Firm Fixed Price PO under U.S. Government Contract (Non-Commercial)General Dynamicsline 1233243GD Mission Systems SCM-TMP-048 — T&M Purchase Orders for Non-Commercial Items in Support of a U.S. Government ContractGeneral Dynamicsline 2161122GD Mission Systems SCM-TMP-095 — FFP Purchase Orders for Commercial/COTS Products or Services in Support of a U.S. Government ContractGeneral Dynamicsline 1095240L3Harris LGL-50.F1 — General T&C and Flowdown Clauses for Other Than Commercial Products/Services under a U.S. Government ContractL3Harrisline 2157106L3Harris LGL-50.F2 — General T&C and Flowdown Clauses for Commercial Products/Services under a U.S. Government ContractL3Harrisline 1518273BAE Systems Inc. USGOVA — FAR/DFARS Flow Down Provisions for Subcontracts/Purchase Orders under a U.S. Government (DoD) Prime ContractBAE Systemsline 112689AAR Government Services — C40 Purchase Order General Provisions, Non-Commercial Firm Fixed Price Items or ServicesAAR Corpline 3085178AAR Component Services NY — U.S. Government Contract FAR and DFARS Clauses Incorporated by ReferenceAAR Corpline 266

Source: acquisition.gov, DFARS 252.204-7009 and 204.7304(b) (verified 2026-08-04)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.