whatbindsCheck your order

Clauses · DFARS · Cybersecurity

DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

Does the regulation require it to flow down?

Yes

When the sub's performance involves covered defense information or operationally critical support — including commercial subs

Form
verbatim (without alteration)
Reaches
all tiers

Checked against acquisition.gov on 2026-08-09 · edition MAY 2024 · base v0.9.3 Read the text ↗

What it makes you produce

7 items for your checklist, slowest first.

  1. A program you have to be running

    You are either running it or you are not, and what the prime asks for is the date it started.

    • The NIST SP 800-171 security requirements, in the version in effect when the solicitation was issued, running on every system of yours that holds or moves the covered information

      Owed when the system is your own — (b)(1) sends an information technology service operated on the Government's behalf to the contract's own terms instead

      252.204-7012(b)(2)(i)

  2. Something somebody else has to issue you2

    The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

    • A DoD-approved medium assurance certificate, bought from an outside certificate authority

      Owed when an incident has to be reported — the certificate is what the reporting channel authenticates against, so it is held before the incident rather than obtained after it

      252.204-7012(c)(3)
    • A cloud service provider meeting security requirements equivalent to the FedRAMP Moderate baseline, and complying with (c) through (g) on reporting and forensics

      Owed when covered information sits on a cloud service you did not build — the paragraph reaches an external provider only

      252.204-7012(b)(2)(ii)(D)

  3. Something you write3

    Days to weeks, and nobody outside your company has to agree to it.

    • A system security plan for each of those systems, and a plan of action for the requirements not yet in place

      Owed when the same systems (b)(2)(i) reaches — the plan and the plans of action are named by NIST SP 800-171 itself rather than by the clause's own words

      252.204-7012(b)(2)(i)
    • A written request to vary from a security requirement, for a DoD Chief Information Officer representative to adjudicate

      Owed when a NIST SP 800-171 requirement is not implemented and you are asking to vary from it

      252.204-7012(b)(2)(ii)(B)
    • A copy of an approval you already hold, provided when you ask for that earlier adjudication to be recognized on this order

      Owed when a DoD Chief Information Officer representative has already ruled that a requirement is not applicable to you, or that an alternative measure is equally effective

      252.204-7012(b)(2)(ii)(C)

  4. Something you fill in and send back

    Hours, once you know which one is missing.

    • A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident

      Owed when an incident affecting a covered system, the covered information on it, or your ability to perform the order is discovered

      252.204-7012(c)(1)(ii)

When it is used

All DoD contracts, including commercial, except exclusively COTS acquisitions. No dollar threshold.

Read closely

Two duties here are running costs rather than deliverables: malicious software goes to the DoD Cyber Crime Center ((d)), and images of affected systems and the relevant monitoring data are held at least 90 days from the report ((e)). The edition in force points at revision 2 of NIST SP 800-171 and its 110 requirements; documents written against the October 2016 edition pin revision 1, so the count depends on which edition the order names.

The 23 templates that name it, with the line
5CORPDOC 2 — General Provisions for Commercial Products/Services under a U.S. Government Prime ContractLockheed Martinline 44076CORPDOC 2A — FAR/DFARS Flowdown Provisions for Commercial Products/Services under a DoD Prime ContractLockheed Martinline 2435CORPDOC 3 — General Provisions for Fixed Price Non-Commercial Subcontracts under a U.S. Government Prime ContractLockheed Martinline 407143CORPDOC 3A — FAR/DFARS Flowdown Provisions for Fixed Price Non-Commercial Items under a DoD Prime ContractLockheed Martinline 3445CORPDOC 4 — General Provisions for Cost-Reimbursement/T&M Subcontracts under a U.S. Government Prime ContractLockheed Martinline 409155CORPDOC 4A — FAR/DFARS Flowdown Provisions for Cost-Reimbursement/T&M Subcontracts under a DoD Prime ContractLockheed Martinline 380233RTX Flowdown of U.S. Government Contract Clauses Under U.S. Government ContractsRTXline 64851Raytheon TC-001 — General Terms and Conditions of PurchaseRTXline 51660Raytheon TC-003 — Supplement 2: Government Contract Provisions from the DFARSRTXline 52166Northrop Grumman CTM-P-ST-001 — U.S. Government Firm Fixed Price Order (Not for Commercial Products and Services)Northrop Grummanline 15669Northrop Grumman CTM-P-ST-002 — U.S. Government FFP or T&M Order for Commercial Products and ServicesNorthrop Grummanline 163166Northrop Grumman CTM-P-ST-003 — U.S. Government T&M Order (Not for Commercial Products and Services)Northrop Grummanline 154168Northrop Grumman CTM-P-ST-004 — U.S. Government Cost Reimbursement Order (Not for Commercial Products and Services)Northrop Grummanline 1546Northrop Grumman CTM-P-ST-005 — Non-U.S. Government Firm Fixed Price OrderNorthrop Grummanline 144255GD Mission Systems SCM-TMP-005 — General Provisions, Firm Fixed Price PO under U.S. Government Contract (Non-Commercial)General Dynamicsline 1238243GD Mission Systems SCM-TMP-048 — T&M Purchase Orders for Non-Commercial Items in Support of a U.S. Government ContractGeneral Dynamicsline 2163122GD Mission Systems SCM-TMP-095 — FFP Purchase Orders for Commercial/COTS Products or Services in Support of a U.S. Government ContractGeneral Dynamicsline 1096240L3Harris LGL-50.F1 — General T&C and Flowdown Clauses for Other Than Commercial Products/Services under a U.S. Government ContractL3Harrisline 991106L3Harris LGL-50.F2 — General T&C and Flowdown Clauses for Commercial Products/Services under a U.S. Government ContractL3Harrisline 1005273BAE Systems Inc. USGOVA — FAR/DFARS Flow Down Provisions for Subcontracts/Purchase Orders under a U.S. Government (DoD) Prime ContractBAE Systemsline 1130107Honeywell — Supplemental Provisions Under Fixed Price U.S. Government Contracts for Commercial ItemsHoneywellline 53689AAR Government Services — C40 Purchase Order General Provisions, Non-Commercial Firm Fixed Price Items or ServicesAAR Corpline 3091178AAR Component Services NY — U.S. Government Contract FAR and DFARS Clauses Incorporated by ReferenceAAR Corpline 279

Source: acquisition.gov, DFARS 252.204-7012, codified text read at DFARS Change 5/7/2026, prescribed at 204.7304(c) with designation (MAY 2024); RFO class deviation 2026-O0025 (DFARS part 240, effective 2026-02-01) prints the same designation but prescribes it at 240.370-5(c), so the clause is unchanged and the prescription has moved into the new part 240 (verified 2026-08-09)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.