Start with the clauses
Cybersecurity obligations are written into the contract's clause sections, usually near the end of the document or in the section labeled contract clauses. The clauses that matter most are part of the Defense Federal Acquisition Regulation Supplement (DFARS). Search the document for these numbers first.
The clauses to look for
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. If present, you must implement NIST SP 800-171 on systems that handle covered defense information, and report cyber incidents within 72 hours.
- DFARS 252.204-7019 and 252.204-7020. These require a current NIST SP 800-171 assessment score posted in the Supplier Performance Risk System (SPRS) before award.
- DFARS 252.204-7021, Cybersecurity Maturity Model Certification Requirements. If present, the contract specifies the CMMC level and requires that level of certification.
What the clauses mean for your business
A contract with 252.204-7012 means your security obligations already apply, even if you have never been asked for a score. A contract with 252.204-7021 means certification is a condition of award at the level specified. The two often appear together, and they can differ between contracts from the same agency.
Where CUI lives
The contract or its statement of work usually describes what information you will handle. Controlled Unclassified Information is the category that drives Level 2 requirements. Map the systems, people, and vendors that touch that information. Your obligations follow the data, so a subcontractor that receives CUI can bring its own requirements into your chain.
Where work can be performed
Some contracts restrict where work can be performed, including offshore access to covered systems or data. Read the performance location and data handling terms, and confirm them with your team and any cloud or offshore providers. A violation here can be as costly as a control gap.
Next steps
- List every active and pending contract and the clauses in each.
- Check your current SPRS score and confirm it reflects reality.
- Identify the systems that handle CUI and the people responsible for them.
- Bring the contract questions to a scoping call so the level and scope are settled before you invest in remediation.
Search your contract for 7012, 7019, 7020, and 7021 before anything else. Those four numbers tell you most of what you need to know to start.
Frequently asked questions
Where do I find the DFARS clauses in my contract?
They are typically in the contract's clause section, often near the end. You can also search the document for '252.204' to find every cybersecurity-related clause quickly.
What is SPRS?
The Supplier Performance Risk System is the DoD database where contractors post their NIST SP 800-171 assessment score. Contracting officers check it before award under the applicable DFARS clauses.
Does 252.204-7012 mean I need CMMC?
Not by itself. 7012 requires NIST SP 800-171 safeguards and incident reporting. CMMC certification is specified by 252.204-7021 when it is included in a contract.
Can I ask the contracting officer about requirements?
Yes. Questions about applicable clauses and requirements should go through the contracting officer, and answers should be kept in your contract file.
Related articles
Want this applied to your company?
A free 30-minute scoping call tells you which frameworks apply and what it would take.