DFARS Cybersecurity Requirements

Clause 252.204-7012 – Safeguarding Covered Defense Information And Cyber Incident Reporting

If your company provides products being sold to the Department of Defense (DoD), you are required to comply with the minimum cybersecurity standards set by DFARS.

All DoD contractors that process, store or transmit Controlled Unclassified Information (CUI) must meet DFARS minimum security standards. Contractors who do not meet these minimum standards risk losing their DoD contracts and losing out on future contract bids.

This DFARS subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in, or transits through, covered contractor information systems by applying specified network security requirements. It also requires reporting of cyber incidents.

DFARS provides a set of adequate security controls to safeguard information systems where contractor data resides. Based on NIST Special Publication 800-171 “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations”, manufacturers must implement these security controls through all levels of their supply chain.

DFARS requirements also include developing a plan of actions and milestones (POAM) and system security plan (SSP).

DFARS: Additional Resources:

• DIBNet Portal: the official gateway for reporting cyber incidents for DoD contractors and sub-contractors
• The DoD Frequently Asked Questions web page addresses common questions on the implementation of DFARS cybersecurity requirements.
• NIST documents for protecting controlled unclassified information in nonfederal systems and organizations:
• SP 800-171 Rev. 2
• CUI Plan of Action template
• CUI SSP template