If you hold a Department of Defense contract, the DFARS clauses incorporated into that contract can create material cybersecurity obligations. CMMC is not wholly paused: Phase 2 and later implementation milestones are suspended, while Phase 1 self-assessment requirements remain in effect and DFARS obligations continue.
That distinction matters more in 2026 than it has in years. A lot of contractors have spent the last eighteen months treating CMMC certification as the finish line and DFARS as the paperwork underneath it. The reverse is closer to the truth. DFARS 252.204-7012 is the clause in your contract. It creates the obligation, it sets the reporting deadline, and it reaches your subcontractors. CMMC is the mechanism for proving you met it.
This guide covers what DFARS actually requires, which clauses bind you, what changed on February 1, 2026, how flow-down works in practice, and the sequence that gets a small or mid-size contractor from “we think we’re fine” to a defensible position.
What DFARS Is — and Which DFARS You’re Being Asked About
DFARS stands for the Defense Federal Acquisition Regulation Supplement. The Federal Acquisition Regulation (FAR) governs how every federal agency buys things; DFARS layers Department of Defense-specific rules on top of it. When a DoD contracting officer writes a solicitation, they pull clauses from both.
Here is the thing nobody tells you before you start searching: “DFARS compliance” describes two almost entirely separate bodies of regulation, and which one applies depends on what you sell.
Sourcing and supply-chain DFARS. If you manufacture or supply physical goods, DFARS compliance likely means domestic-sourcing restrictions. DFARS 252.225-7009 restricts specialty metals — stainless steel, titanium, nickel and cobalt-based alloys, zirconium — to metal melted in the United States or a qualifying country. The Berry Amendment (10 U.S.C. 4862) covers food, clothing, tents, hand tools and measuring instruments under a separate statute with its own exception structure. A metals distributor telling a customer they are “DFARS compliant” is talking about melt origin, not cybersecurity.
Cybersecurity DFARS. If you handle DoD information — drawings, specifications, technical data, contract deliverables — DFARS compliance means the 252.204-70xx clause family and the security standard underneath it. That is what this guide covers, and it is what the overwhelming majority of contractors searching for DFARS compliance actually need.
The two get conflated constantly. If a prime asks for “DFARS compliance” or a “DFARS certification,” confirm which clause or requirement it means; the phrase is not a single government-issued certification.
The DFARS Cybersecurity Clauses That Bind You
Six clauses and provisions do the work. Most contractors have several of them in their contracts without ever having read them.
- 252.204-7008 — a solicitation provision. By submitting an offer, you represent that you will implement the required security controls by the time of award, or you request a variance in writing beforehand.
- 252.204-7012 — the anchor. Safeguarding covered defense information and cyber incident reporting. This is the clause that creates the substantive obligation.
- 252.240-7997 — government-led assessments. Under class deviation 2026-O0025, this clause replaces the role previously served by 252.204-7020 for affected solicitations and contracts and was substantively revised to cover Medium and High government assessments.
- 252.204-7021 — the CMMC clause. Requires you to hold and maintain the CMMC level named in your contract, and to flow that level down.
- 252.204-7024 — tells contracting officers to weigh your Supplier Performance Risk System (SPRS) data when evaluating your offer. You do nothing under this clause; it determines how your score gets used against you.
- 252.204-7025 — a notice provision stating which CMMC level a solicitation requires. An offeror without that status in SPRS is not eligible for award.
Three of those carry obligations you have to act on. Here is how they differ.
The practical upshot: 7012 is where your security obligation lives, 7021 is where your proof obligation lives, and 7997 is DoD’s authority to check your work regardless of which path you took to meet the requirements.
DFARS 252.204-7012 in Practice
Everything else is downstream of this clause, so it is worth understanding what it actually says rather than what people say it says.
Adequate security means NIST SP 800-171. The clause requires you to implement the security requirements in NIST Special Publication 800-171 on any covered contractor information system that processes, stores or transmits covered defense information. That is 110 requirements across 14 families — access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. A separate DoD class deviation pins the applicable version at Revision 2, not Revision 3, despite the clause text referring to the most current version.
If you cannot implement a given requirement, the clause contemplates a written variance request submitted to the contracting officer for the DoD CIO’s consideration — before award, not after a finding.
Incidents get reported in 72 hours. On discovering a cyber incident affecting a covered system or the covered defense information on it, you conduct a review for compromise and report within 72 hours of discovery at dibnet.dod.mil. That portal requires a DoD-approved medium assurance certificate, which takes time to obtain. Contractors discover this at the worst possible moment. Get it in advance.
Three obligations follow the report and are routinely missed. You must submit any discovered malicious software to the DoD Cyber Crime Center (DC3), not to your contracting officer. You must preserve images of all affected systems and relevant monitoring and packet capture data for at least 90 days from submission of the report. And you must provide DoD access to information and equipment for forensic analysis on request.
Cloud is not a loophole. If you use an external cloud service provider to store, process or transmit covered defense information, DFARS 252.204-7012 requires that provider to meet security requirements equivalent to the FedRAMP Moderate baseline and comply with specified incident-reporting, media-preservation, and forensic-support requirements. The appropriate Microsoft environment depends on the contract, data type, and applicable restrictions: GCC can support DFARS and FedRAMP High scenarios, while GCC High is designed for DoD IL4 and ITAR-sensitive workloads. The key is to select and configure the environment to the actual requirement rather than treating GCC High as universal.
Working out which of the 110 requirements you actually meet — with evidence, not intent — is what a NIST 800-171 assessment is for. Most organizations coming to it for the first time find 30 to 50 requirements unimplemented. That number is normal. What separates a manageable project from an expensive one is the order you fix them in.
What Changed on February 1, 2026
This is the part that current DFARS guides mostly have not caught up to, and it changes which clause numbers you should expect to see in new contracts.
As part of the Revolutionary FAR Overhaul, the Department of Defense issued a batch of 38 DFARS class deviations effective February 1, 2026. The one that matters here is class deviation 2026-O0025, which stood up a new DFARS Part 240 covering information security and supply chain security. It has been revised since February; Revision 3, dated September 3, 2026, superseded Revision 2 (July 16, 2026) and is the current version as of this writing, so check the current revision rather than the original issue. Three things happened:
- Under class deviation 2026-O0025, contracting officers are directed not to use the former standalone 252.204-7019 provision in the deviated Part 240 structure. Because the change was implemented by class deviation rather than final rulemaking, the codified DFARS still carries the legacy provision.
- Under class deviation 2026-O0025, 252.204-7020 is replaced for affected solicitations and contracts by 252.240-7997 and substantively revised. References to a “Basic” assessment are removed; the deviated clause addresses Medium and High assessments performed by trained government personnel using NIST SP 800-171A.
- Under the FAR Part 40 class-deviation structure, affected acquisitions use FAR 52.240-93 in place of the legacy FAR 52.204-21 clause. Because this is a deviation transition rather than a simple codified renumbering, both references may remain in circulation; the 15 basic safeguarding requirements are unchanged.
Two cautions. First, this was done by class deviation, not by rulemaking — which means the codified DFARS text still shows 252.204-7019 and 252.204-7020 while contracting officers are directed to use the deviated clauses. You will see both numbering schemes in circulation until rulemaking catches up. Read the clause list in your actual contract rather than assuming. The deviated Part 240 text itself is published on the OSD Defense Pricing and Contracting site, and the clause carries the designation NIST SP 800-171 DoD Assessment Requirements (FEB 2026) (DEVIATION 2026-O0025).
Second, and more important: none of this reduced what you owe. The assessment obligation did not disappear. If you handle CUI, you still assess yourself against all 110 requirements and you still put a score and an annual affirmation into SPRS — that duty is now addressed through the CMMC clause at 252.204-7021 and applicable contract clauses rather than the former standalone 252.204-7019 provision. And DoD retained its own verification authority in full: under 252.240-7997, Medium and High assessments conducted by the Defense Contract Management Agency’s DIBCAC teams take precedence over any other assessment, you have 14 business days to rebut findings before the score posts to SPRS, and the resulting score is visible to every contracting officer evaluating your offers.
Where the CMMC Program Stands Today
Last reviewed: October 22, 2026
On July 13, 2026, DoD announced the immediate suspension of CMMC Phase 2 requirements — the third-party C3PAO assessment milestone that had been scheduled to take effect on November 10, 2026 — along with later implementation milestones. The CMMC Reform Task Force was directed to deliver a final report to the Department CIO within 60 days. No public replacement Phase 2 schedule has been announced; Phase 1 self-assessment requirements remain in effect, and Phase 2 remains suspended. During the suspension, the Department is enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. The underlying Level 2 (C3PAO) provisions remain in 32 CFR Part 170; their Phase 2 implementation has been suspended, not eliminated.
What did not change:
- Phase 1 remains in effect, as it has since November 10, 2025. The Department currently may require Level 1 annual self-assessments and Level 2 (Self) assessments every three years, with the applicable affirmations entered in SPRS.
- DFARS 252.204-7012 remains fully in force, including the 72-hour reporting obligation.
- NIST SP 800-171 Rev 2 is still the standard, enforced through self-assessments and select government-led assessments.
- Prime contractor flow-down obligations remain contractual and are unaffected.
During the suspension, self-assessment is the operative CMMC mechanism — which means the document carrying your legal exposure is one you fill out yourself. The pause changed when and how implementation gets independently verified. It did not pause the duty to implement the requirements, and it did not pause enforcement.
How DFARS, NIST 800-171 and CMMC Fit Together
The three get used interchangeably, which is why so many contractors are confused about what they are actually being asked for. They are three different things, stacked.
DFARS is the contract. Clause 252.204-7012 is a term of your agreement with the government. It creates a legal obligation the moment the contract is signed.
NIST SP 800-171 is the standard. It is a National Institute of Standards and Technology publication describing 110 security requirements for protecting CUI in non-federal systems. On its own it is guidance. DFARS 7012 is what makes it binding on you.
CMMC is the assessment and verification framework layered onto existing safeguarding requirements. It does not replace the underlying FAR/DFARS duties. Level 1 addresses FCI and currently requires annual self-assessment and affirmation against the 15 FAR basic safeguarding requirements. Level 2 addresses CUI and currently permits the Level 2 (Self) path in Phase 1, using all 110 NIST SP 800-171 Rev 2 requirements, an SSP, and limited POA&M treatment where permitted. The standing model also includes Level 2 certification and Level 3 government assessment when later phases resume.
The requirements did not get harder when CMMC arrived. The evidentiary standard did. For a level-by-level breakdown, see our guides to CMMC Level 1 requirements and CMMC Level 2 requirements.
Which DFARS Obligations Actually Apply to You
Scope is determined by what information you handle under the contract — not by your company size, your headcount, or how deep in the supply chain you sit.
The two information categories that drive everything above are worth stating precisely, because contractors routinely guess wrong about which one they hold. Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information (CUI) is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. Technical drawings, specifications, export-controlled data, and engineering deliverables may be CUI when designated or governed that way, but those labels alone do not make every item CUI. The presence of 252.204-7012 in a contract should trigger careful scoping; it does not by itself prove that every system or deliverable contains CUI.
Subcontractor Flow-Down: What Primes Owe and What Subs Inherit
Flow-down is where mid-tier suppliers get caught, because the obligation arrives through a commercial document rather than a government one. You will never receive a letter from DoD. You will receive a subcontract with clauses in it.
7012 flows down verbatim. The clause requires the contractor to “include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties.” No negotiating it down. No substituting your own security language.
Subcontractors report twice. A sub that experiences a cyber incident reports it to DoD through dibnet.dod.mil on the same 72-hour clock and provides the incident report number to the prime as soon as practicable. A sub seeking a variance from a NIST 800-171 requirement must notify the prime.
The assessment clause flows down too. DFARS 252.240-7997 requires the substance of the clause, including its flow-down paragraph, in all subcontracts other than those solely for COTS items.
CMMC level flows down by scope. Under 252.204-7021, a prime must ensure subcontractors handling FCI or CUI hold the appropriate CMMC level before the subcontract is awarded. The level required of a sub is driven by what that sub handles, which is not always what the prime holds.
Then there is the commercial reality beyond the clause text. Prime contractors may use approved-vendor processes and cybersecurity questionnaires to manage supply-chain risk. A supplier that cannot demonstrate required cybersecurity posture may lose an award or future opportunities. The practical advantage is being able to respond quickly with current documentation and evidence.
Steps to Achieve DFARS Compliance
There is a correct order to this work, and following it is most of the difference between a six-month project and an eighteen-month one.
What goes wrong at each stage is predictable.
Scoping is the decision that sets your cost. Every system in scope gets assessed, remediated and maintained. Contractors who skip straight to buying security tools can end up hardening a broader corporate network than necessary when CUI could instead be concentrated in a properly designed controlled enclave. That enclave may use GCC High where contract, CUI category, ITAR, or DoD impact-level requirements make it appropriate; the platform choice should follow the scoped requirement.
Gap assessment surfaces the number. Thirty to fifty unimplemented requirements out of 110 is the normal starting position, not a crisis. Sequencing is what matters — some requirements are configuration changes, some are policy documents, and some are architectural decisions that take months.
The System Security Plan is the first thing an assessor reads. It describes how each of the 110 requirements is implemented in your specific environment. A generic template with your logo on it is among the most common reasons an assessment stalls. Write it against your actual architecture.
The POA&M is a schedule, not a parking lot. It documents what is not yet implemented and by when. Milestones that have quietly passed are worse than no POA&M at all.
Submission is not the end. A score, an annual senior-official affirmation, and evidence maintained across the certification cycle. Security posture decays — new systems, new staff, changed configurations — and the clause obligations are continuous.
Abel Solutions runs this sequence for small and mid-size defense contractors from our Atlanta base, from CUI discovery through mock assessment. As a Microsoft Solutions Partner with more than 30 years in IT, we handle both sides of the problem: the assessment documentation and the Microsoft 365 and GCC High environment it describes. We are not a C3PAO and never will be — we prepare organizations for assessment, which keeps the certification independent. Our CMMC consulting services page walks through the full methodology.
What Non-Compliance Costs
Three distinct exposures, and contractors tend to be aware of only the first.
Award eligibility. Under 252.204-7025, an offeror without the required CMMC status in SPRS is not eligible for award when that status is required by the solicitation. Under 252.204-7024, contracting officers consider applicable SPRS supplier risk data in source selection. A weak or stale assessment can therefore affect award evaluation.
Contractual remedies. Failure to comply with a material contract term exposes you to stop-work orders, termination for default, and in serious cases suspension or debarment from DoD contracting.
False Claims Act liability. This is the expensive one, and it did not pause with Phase 2. The Department of Justice’s Civil Cyber-Fraud Initiative pursues contractors whose cybersecurity representations allegedly do not match contractual requirements or actual practices. Honeywell Aerospace agreed to pay $2,042,518 in a settlement announced September 1, 2026, resolving allegations that it failed to comply with NIST SP 800-171 requirements on one network between April 2020 and December 2023. LOGZONE Inc. agreed to pay $507,144 on June 18, 2026, after a government assessment scored its environment at −170. Raytheon and Nightwing agreed to pay $8.4 million in a settlement announced May 1, 2025, resolving allegations involving 29 DoD contracts and subcontracts. The claims in these settlements were allegations; there was no determination of liability.
Read the LOGZONE gap against the current moment. While third-party assessment is suspended, self-assessment is the operative mechanism, and DIBCAC retains authority to come verify the number you submitted. An inaccurate SPRS score is not an administrative error. It is a representation to the government, and it is discoverable years later.
Frequently Asked Questions
What is DFARS compliance?
For a contractor handling DoD information, DFARS compliance means implementing the 110 security requirements in NIST SP 800-171 Rev 2 on any system that processes, stores or transmits covered defense information, reporting cyber incidents within 72 hours, maintaining a System Security Plan and POA&M, and flowing the same obligations down to subcontractors — all as required by DFARS clause 252.204-7012. For manufacturers and material suppliers, “DFARS compliance” often refers instead to domestic-sourcing rules such as the specialty metals restriction at 252.225-7009. The two are unrelated.
Is DFARS still required now that CMMC Phase 2 is suspended?
Yes, and it is more consequential than before. The July 13, 2026 suspension applies to the third-party C3PAO assessment milestone and the milestones that would have followed it. DFARS 252.204-7012, NIST SP 800-171 Rev 2, the SPRS score and annual affirmation, and prime flow-down all remain in force. What the suspension changed is how implementation gets verified, not whether you have to implement the requirements.
What happened to DFARS 252.204-7019 and 7020?
Under class deviation 2026-O0025, effective February 1, 2026, the former standalone 252.204-7019 provision is not used in the deviated Part 240 structure, and 252.204-7020 is replaced for affected solicitations and contracts by 252.240-7997 with references to Basic self-assessments removed. The deviated clause covers Medium and High government assessments. The self-assessment and SPRS obligation did not disappear; it is addressed through the CMMC framework and applicable contract clauses. Because this was done by class deviation rather than rulemaking, both numbering schemes remain in circulation; check the clause list in the specific contract. Revision 3 of the deviation is dated September 3, 2026.
Do DFARS requirements apply to subcontractors?
Yes. DFARS 252.204-7012 must be included in subcontracts for operationally critical support or involving covered defense information without alteration except to identify the parties, and applies at every tier, including subcontracts for commercial products and services. Subcontractors report incidents directly to DoD and provide the incident report number to their prime. The obligation reaches you through your subcontract, not through a notice from the government.
How long does it take to become DFARS compliant?
For a small to mid-size contractor starting from a typical position — 30 to 50 of the 110 requirements unimplemented — six to twelve months is realistic when scoping is done well and remediation is properly sequenced. Organizations that skip scoping and try to secure their entire corporate network routinely spend longer and more.
Do we need Microsoft 365 GCC High for DFARS compliance?
Not universally. DFARS 252.204-7012 requires an external cloud service provider storing, processing, or transmitting covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline and comply with specified incident-response obligations. Microsoft 365 GCC and GCC High support different government requirements; GCC High is designed for DoD IL4 and ITAR-sensitive scenarios. The correct environment depends on the contract, CUI category, export-control obligations, and required impact level rather than on CUI status alone.
What is a SPRS score and how is it calculated?
The Supplier Performance Risk System holds your NIST SP 800-171 assessment score. Scoring starts at 110 and subtracts weighted points for each unimplemented requirement — 5, 3 or 1 point depending on the requirement’s impact — which is how a score can go deeply negative, as LOGZONE’s −170 did. Contracting officers see it when evaluating your offers.
Get a Clear Picture of Where You Actually Stand
Most contractors we talk to are not sure which DFARS clauses are in their contracts, which systems are in scope, or whether the score sitting in SPRS still reflects reality. That uncertainty is a bigger risk than a low score, because you cannot fix what you have not measured — and during a suspension, self-assessment is the record the government will hold you to.
We start with scoping and a gap assessment against all 110 requirements, then give you a sequenced remediation plan with the cost consequences of each scoping decision made explicit. Right-sized for a growing business, not built to enterprise scale you do not need.
