DFARS

The Defense Federal Acquisition Regulation Supplement is the Department of Defense's supplement to the Federal Acquisition Regulation. In compliance conversations "DFARS" almost always means the 252.204-70xx cybersecurity clauses.

DFARS 252.204-7012 requires contractors that handle covered defense information to implement the 110 requirements of NIST SP 800-171, report cyber incidents to DoD within 72 hours, preserve images and logs, and flow the clause down to subcontractors.

DFARS 252.204-7019 and 7020 require a current NIST SP 800-171 self-assessment score posted in the Supplier Performance Risk System (SPRS) and allow DoD to conduct its own assessments; in contracts written under the 2026 Part 240 class deviation, a single clause, 252.240-7997, takes their place.

It keeps government Medium and High assessments by the Defense Contract Management Agency, with the Department posting those scores in SPRS, but it contains no self-assessment requirement of its own and no rule that a score be no more than three years old; where a contract names a CMMC level, the CMMC clause (252.204-7021) requires a current self-assessment in SPRS, which for Level 2 means not older than three years.

DFARS 252.204-7021, rewritten by the final rule published September 10, 2025 and effective November 10, 2025, ties contract eligibility to holding the CMMC level named in the solicitation.

In writing, a contractor needs a system security plan that describes how each NIST SP 800-171 requirement is met, plans of action and milestones for gaps, the SPRS score and its basis, incident response procedures aligned to the 72-hour reporting rule, subcontractor flow-down and verification records, and, under CMMC, the annual affirmation by a senior official.

The rule phases CMMC into contracts over three years; Phase 1 (self-assessments) began November 10, 2025, and the transition to Phase 2 third-party certification was suspended on July 13, 2026 pending a program review, which Class Deviation 2026-O0025 made binding on contracting officers (Revision 2 of July 16, 2026 and Revision 3 of September 3, 2026).

Since late 2025 the Department has also been rewriting DFARS under the Revolutionary FAR Overhaul: contracting officers use rewritten parts issued as class deviations "in lieu of the text codified at 48 CFR chapter 2", ahead of formal rulemaking. Contracts awarded under the older text keep the clauses they were written with.

Beyond cybersecurity, DFARS also sets sourcing rules that small manufacturers meet often, such as the specialty metals clause (252.225-7009) for certain defense products above the simplified acquisition threshold.