What is DFARS? Explained simply

The problem it is meant to solve

Federal agencies buy under one shared rulebook, the Federal Acquisition Regulation (the FAR). The Department of Defense (now also called the Department of War in its own documents) has needs of its own, and Congress has passed laws only for defense buying.

DFARS, the Defense Federal Acquisition Regulation Supplement, holds those extra rules. It sits on top of the FAR, not in place of it. The part that reaches you is standard contract terms, called clauses, copied into defense contracts and the subcontracts under them.

What it actually asks you to do

DFARS asks nothing of you until a clause lands in your contract. These are the ones small suppliers meet most.

Protecting defense information. If you hold certain sensitive but unclassified defense information, such as controlled technical drawings, you must protect the computer systems it sits on. The baseline is 110 security requirements in a guide from the National Institute of Standards and Technology (NIST, the federal standards body) called Special Publication 800-171, Revision 2.

You must report a cyber incident to the Department within 72 hours of discovering it and keep images of affected systems for at least 90 days.

Scoring yourself. Contracts can require a self-assessment score against those requirements in the Department's Supplier Performance Risk System, and let government assessors check it.

Cybersecurity certification. A contract can name a Cybersecurity Maturity Model Certification (CMMC) level you must hold, with a yearly affirmation by a senior official.

Where materials come from. Some contracts above the simplified acquisition threshold (the federal small-purchase limit), mainly for aircraft, missiles and space systems, ships, military vehicles, weapon systems, ammunition and their parts, require certain specialty metals, such as titanium and some high-alloy steels, to be melted or produced in the United States, its territories or a "qualifying country" (one with a reciprocal defense buying agreement).

There are exceptions, such as electronic components and most off-the-shelf commercial items. Others require U.S.-made end products unless your offer said otherwise.

Passing it down. Many clauses must be copied into your own subcontracts, so the rules follow the work down the supply chain.

What it is not

It is not a certificate. DFARS itself certifies nobody.

It does not cover every business. It reaches you through contracts, and only the clauses in yours apply. Selling only commercially available off-the-shelf items keeps you outside several, including the cyber one.

It is not CMMC either. CMMC is a separate program with its own rule; DFARS is the contract route that brings it into a deal.

What it looks like in a real company

Take a 40-person machine shop that makes brackets for a military truck. A larger defense contractor sends a purchase order with a page of DFARS clauses and a set of drawings marked as controlled.

The shop reads which clauses are in the order, because only those apply. The drawings bring in the cyber clause, so it finds every computer and account that touches them. It writes a system security plan covering the 110 requirements, lists gaps with target dates, scores itself using the Department's method and has the score posted.

The order names a self-assessed CMMC level, so a senior manager signs a yearly affirmation.

The specialty metals clause is there too, so the shop asks its steel supplier where the metal was melted. When it sends drawings to a heat-treater, the cyber clause goes into that subcontract.

How it cuts metal does not change.

Who deals with it day to day

Usually two people. One handles contracts, often the owner, and reads each order's clauses. The other runs IT, often an outside provider, and does the security work.

Around them, a senior official signs any CMMC affirmation and purchasing chases supplier paperwork on metals.

Why a business bothers

Because the clauses come with the work. Accepting a defense order means accepting its clauses, and a prime contractor has to pass many of them down to you.

Who writes it and who checks it

The Department writes DFARS through its Defense Acquisition Regulations System. Its official text sits in the Code of Federal Regulations, Title 48, Chapter 2.

2026 is unusual. Under the Revolutionary FAR Overhaul, a plain-language rewrite of the FAR, the Department has issued "class deviations" telling contracting officers to use rewritten parts of DFARS instead of the published text. So the official text and a new contract can differ.

Your contract's text is what binds you.

The deviation carrying the cyber clauses, revised September 3, 2026, also tells contracting officers to remove third-party CMMC certificate requirements. The Department suspended the second phase of CMMC on July 13, 2026.

For now new requests may ask only for self-assessed CMMC levels, and contracts that already require a third-party certificate are to be changed at their next option or administrative change. Revision 2 of the NIST guide still applies.

Your contracting officer checks, as do Defense Contract Management Agency assessors when the Department chooses to assess, and your prime contractor for the clauses it passes down.

Where it leads next

Three things are pending. The Department plans to move to Revision 3 of the NIST guide, which has 97 requirements, but no rule has appeared. A CMMC review was due around September 11, 2026, and its findings are not yet public.

And the overhaul continues, with proposed FAR and DFARS rules planned for public comment.

Before changing anything, ask your contracting officer or prime contractor which version of each clause applies.