The clause tells you the outcome it wants. It does not tell you which systems are in scope, who owns the plan, or what you do at 2am on the day something happens. That part is ours.
Two neighbors worth naming rather than blurring. The control set the clause points at is NIST 800-171 compliance, and the program that verifies you meet it is CMMC compliance. This page is about the clause that makes both of them contractual.
DFARS is where defense cybersecurity stops being advice and becomes a term of your contract. These are the parts that land on IT, in the order they land.
Clause numbers, titles and requirements are taken from the DFARS clause text published by the Department of Defense at acquisition.gov. This page is not legal advice on the interpretation of your contract.
The clause protects covered defense information, which includes controlled unclassified information given to you and information you generate performing the contract. Scoping it is the first decision, because every other requirement follows the boundary you draw.
DFARS 252.204-7012 requires adequate security on the systems that hold that information, and defines adequate security as implementing NIST SP 800-171. It also requires you to report a cyber incident to the Department of Defense within 72 hours of discovering it, preserve affected system images for at least 90 days, and submit malicious software when asked.
DFARS 252.204-7019 makes eligibility for award conditional on having a current NIST SP 800-171 Basic Assessment posted in the Supplier Performance Risk System. Current means not more than three years old, which makes the score a standing obligation rather than a bid task.
DFARS 252.204-7020 commits you to giving the Department of Defense access to conduct a Medium or High assessment of how you have implemented the controls, and to carrying the same requirement into your subcontracts.
DFARS 252.204-7021 brings CMMC requirements into applicable contracts. When the clause applies, the contractor must achieve and maintain the required CMMC status for the information systems covered by the contract and complete the required annual affirmation of continuous compliance.
These clauses do not stop with you. Where a subcontractor handles the same information, the requirement goes into their agreement too, which means their gaps become your problem at award time.
Hear from ITS clients about the security, compliance, and operational improvements they have experienced working with our team.
I think... to not adopt some form of advanced security these days would be incredibly foolish. The biggest benefit ITS provides is the weight off my shoulders knowing that they’re involved, and we’ve prepared ourselves as best as we could for any cyberthreats. That component is the most important to us.
What you don’t want is someone from another country shutting you down and taking all of your money, because this is our livelihood. You are keeping us secure so we can sleep at night and help us make sure all of our 600+ employees have a job tomorrow.
A working session on the clauses in your contract, what is actually in scope, and whether your SPRS score matches your systems. The gaps in writing, yours to keep.
