If your company supports the Department of Defense as a prime contractor or subcontractor, cybersecurity is more than an IT concern. It can directly affect your eligibility for contract awards, option years, purchase orders, and future work within the Defense Industrial Base.
Three requirements frequently create confusion: DFARS 7012, DFARS 7019, and the Cybersecurity Maturity Model Certification program. Although these requirements are connected, they serve different purposes.
In simple terms:
- DFARS 7012 requires covered defense information to be safeguarded and cyber incidents to be reported.
- DFARS 7019 requires a current NIST SP 800-171 DoD Assessment score in the Supplier Performance Risk System when applicable.
- CMMC provides a structured process for verifying that required cybersecurity protections have actually been implemented.
Understanding the relationship among these requirements is essential for protecting Controlled Unclassified Information, avoiding inaccurate representations, and competing successfully for defense contracts.
CMMC IT Support is a San Diego-based consultancy that helps DoD contractors and subcontractors prepare for and maintain CMMC Level 2 compliance. If you are unsure which requirements apply to your organization, schedule a free compliance call, call 858-483-8770, or email info@cmmcitsupport.us.
What Is DFARS Compliance?
The Defense Federal Acquisition Regulation Supplement, commonly called DFARS, contains acquisition requirements that apply specifically to Department of Defense contracts.
The cybersecurity clauses found in DFARS are designed to protect sensitive government information throughout the defense supply chain. Depending on the contract and information involved, contractors may need to:
- Protect covered defense information within covered contractor information systems
- Implement applicable NIST SP 800-171 security requirements
- Maintain a documented System Security Plan
- Conduct and report a NIST SP 800-171 DoD Assessment
- Report qualifying cyber incidents
- Preserve and provide information needed for forensic analysis
- Verify subcontractor compliance before awarding certain subcontracts
- Maintain the required CMMC status when a contract includes that requirement
These obligations can apply to small subcontractors as well as large prime contractors. A company does not need to manufacture weapons or operate on a military installation to be affected. Engineering firms, machine shops, software developers, professional service providers, laboratories, and other suppliers may all receive information requiring protection.
How DFARS CMMC Requirements Work Together
The phrase DFARS CMMC is often used as if DFARS and CMMC were a single requirement. They are better understood as related layers of DoD cybersecurity oversight.
DFARS 7012 establishes contractual safeguarding and incident-reporting duties. DFARS 7019 and DFARS 7020 support the DoD’s assessment and SPRS reporting process. DFARS 7021 introduces contract-specific CMMC status requirements.
Together, the clauses help the DoD answer three important questions:
- Is the contractor required to protect covered defense information?
- Has the contractor evaluated and reported its implementation of NIST SP 800-171?
- Does the contractor have the CMMC status required for the information systems used on the contract?
A high SPRS score is not automatically the same as a CMMC certification. Likewise, preparing for a CMMC assessment does not eliminate the cyber incident reporting and cloud-service obligations found in DFARS 7012.
A complete compliance program must address the requirements applicable to the organization’s contracts, data, systems, personnel, service providers, and subcontractors.
What Does DFARS 7012 Require?
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is one of the most important cybersecurity clauses for DoD contractors.
When applicable, DFARS 7012 requires contractors to provide adequate security for covered defense information residing in or passing through a covered contractor information system. It also establishes requirements involving cyber incident reporting, malicious software, preservation of system information, forensic access, cloud services, and subcontractor flow-downs.
Protecting Covered Defense Information
Covered defense information includes certain unclassified information requiring safeguarding or dissemination controls when that information is identified in the contract or handled in support of contract performance.
Contractors should know:
- What sensitive information they receive or create
- Where that information is stored
- How it is transmitted
- Which employees and vendors can access it
- Which devices, applications, networks, and facilities are in scope
- Whether the information must be shared with subcontractors
Without an accurate data-flow analysis, an organization may overlook systems that should be included in its security boundary.
Implementing NIST SP 800-171
DFARS 7012 generally requires covered contractor information systems to implement the applicable version of NIST SP 800-171 specified by the clause and contract.
A checklist alone is not enough. Contractors should be able to demonstrate how requirements are implemented through technical configurations, written policies, operational procedures, records, and other objective evidence.
Examples may include:
- Multifactor authentication
- Access-control configurations
- Security-awareness training records
- Incident-response procedures
- Audit logs and log-review records
- Media protection procedures
- Risk and security assessment documentation
- Configuration-management records
- A current System Security Plan
Cyber Incident Reporting
When a qualifying cyber incident is discovered, DFARS 7012 requires the contractor to conduct a review for evidence of compromise and rapidly report the incident through the DoD reporting process. The clause also contains obligations concerning malicious software, preservation of affected system information, and access for forensic analysis.
The current clause language and related reporting instructions should always be reviewed when creating an incident-response plan. The authoritative text is available from the government’s DFARS 252.204-7012 page.
Cloud Service Providers
If an external cloud provider stores, processes, or transmits covered defense information, DFARS 7012 requires the contractor to ensure the provider satisfies the cloud-security obligations stated in the clause, including security equivalent to the FedRAMP Moderate baseline and applicable incident-handling requirements.
Buying a popular commercial cloud subscription does not automatically make an environment compliant. Licensing, product configuration, data location, administrative access, logging, contracts, and the provider’s ability to meet DFARS obligations must all be evaluated.
Request a CMMC and DFARS readiness quote if you need help reviewing your Microsoft 365, Azure, cloud, network, or endpoint environment.
What Does DFARS 7019 Require?
DFARS 252.204-7019 is the Notice of NIST SP 800-171 DoD Assessment Requirements.
When an offeror is required to implement NIST SP 800-171, DFARS 7019 generally requires a current assessment for each covered contractor information system relevant to the offer. The summary-level assessment score must be posted in the Supplier Performance Risk System, commonly known as SPRS.
Under the current clause, an assessment is generally considered current when it is no more than three years old, unless the solicitation specifies a shorter period. Contractors should verify the exact requirements of every solicitation rather than assuming that one score will cover every opportunity.
The official provision explains the current award and reporting requirements in DFARS 252.204-7019.
Basic, Medium and High Assessments
The NIST SP 800-171 DoD Assessment Methodology includes three assessment levels:
- Basic Assessment: A contractor-generated assessment with a low confidence level
- Medium Assessment: A government-led review that includes a detailed document review and discussions with the contractor
- High Assessment: A government-led examination that can include validation, demonstrations, and verification of implemented requirements
Results are recorded in SPRS to give authorized DoD personnel visibility into a contractor’s assessment status.
Why an Accurate SPRS Score Matters
An SPRS score should be supported by the organization’s actual implementation and evidence. Treating the score as a marketing estimate or aspirational target can create substantial contractual and legal risk.
Before submitting or affirming an assessment, a contractor should confirm:
- The correct assessment scope
- The applicable CAGE codes
- The relevant System Security Plan
- The NIST SP 800-171 version used
- The status of each assessed requirement
- The supporting evidence
- Any applicable Plans of Action and Milestones
- The expected completion date for outstanding work
- The accuracy of the submitted summary score
CMMC IT Support can help your team evaluate its environment, identify unsupported assumptions, prioritize remediation, and prepare documentation. Schedule a free compliance call today.
What Is DFARS 7020?
DFARS 252.204-7020 contains the operational requirements for NIST SP 800-171 DoD Assessments.
The clause requires contractors to provide the government with access to facilities, systems, and personnel when needed to conduct a Medium or High Assessment. It also addresses assessment results, the SPRS process, and subcontractor obligations.
Importantly, a prime contractor generally may not award a subcontract subject to NIST SP 800-171 implementation requirements unless the subcontractor has completed at least a current Basic Assessment for the relevant covered contractor information systems.
This means cybersecurity readiness can affect more than direct DoD awards. A subcontractor may face a compliance data request from its prime contractor before receiving a purchase order or renewal.
What Is DFARS 7021?
DFARS 252.204-7021 establishes contractual requirements for maintaining the CMMC status specified in a contract.
When the clause includes a required level, the contractor must generally:
- Maintain a current CMMC status at that level or higher
- Cover each applicable information system used to process, store, or transmit FCI or CUI
- Complete the required annual affirmation of continuous compliance in SPRS
- Protect FCI and CUI only on systems with the appropriate CMMC status
- Flow the correct CMMC requirement down to applicable subcontractors
- Verify subcontractor status before awarding certain contractual instruments
- Notify the contracting officer of specified changes affecting CMMC status or system identifiers
The precise obligations are stated in the current DFARS 252.204-7021 clause.
Current CMMC Implementation Status
CMMC contract implementation began with Phase 1 on November 10, 2025. However, in July 2026, the Department announced the suspension of the transition to Phase II and pending future implementation milestones while conducting a broader program review.
The announcement specifically stated that Phase I self-assessment requirements remain in place. It also emphasized that the suspension does not remove contractors’ existing obligations to safeguard covered defense information under DFARS 7012. During the review period, the Department said it would continue enforcing NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments.
Contractors should therefore avoid two dangerous assumptions:
- A suspended implementation phase does not mean DFARS cybersecurity requirements have disappeared.
- A future C3PAO assessment delay does not make it safe to postpone security remediation.
Read the government’s July 2026 CMMC Phase II suspension announcement and continue monitoring official contract guidance.
Because the program is under active review, organizations should verify the latest requirements before relying on a previously prepared compliance timeline.
What Happens During a CMMC Assessment?
A CMMC assessment evaluates whether cybersecurity requirements have been implemented within a defined assessment scope.
Depending on the required CMMC level and the contract, the assessment may be a self-assessment, a C3PAO certification assessment, or a government-led assessment.
Preparing the Assessment Scope
Scoping is one of the most important parts of preparation. The assessment boundary may include more than the server or cloud folder where CUI is stored.
Assets that process, store, transmit, secure, or provide protection for CUI may need to be evaluated. This can involve:
- Employee workstations
- Servers and cloud workloads
- Microsoft 365 environments
- Identity and access-management systems
- Firewalls and network equipment
- Security monitoring tools
- Backup systems
- Mobile devices
- Managed service providers
- External service providers
- Facilities and physical safeguards
Poor scoping can create unexpected costs or leave critical assets outside the compliance program.
Producing Objective Evidence
Assessors do not rely only on verbal assurances. They may examine documents, interview personnel, and test or observe technical processes.
Effective evidence can include policies, screenshots, configurations, tickets, logs, training records, meeting records, completed reviews, inventories, diagrams, and reports. The evidence should show that practices are implemented consistently—not merely planned.
Addressing Gaps Before the Assessment
A readiness review should identify gaps early enough to allow for remediation and evidence collection. Certain limited deficiencies may be eligible for a Plan of Action and Milestones under CMMC rules, but organizations should not assume every requirement can be deferred.
The safest approach is to enter the formal assessment with a mature, well-documented environment and staff who understand their responsibilities.
How to Achieve CMMC Level 2 Compliance
CMMC Level 2 compliance aligns with the 110 security requirements derived from NIST SP 800-171 Revision 2 and is intended to protect Controlled Unclassified Information.
Achieving it usually requires coordinated work across technology, documentation, people, vendors, and management.
Identify FCI and CUI
Begin by determining what information your organization receives, creates, stores, processes, and transmits. Confirm contractual markings and data requirements with the appropriate contract stakeholders when necessary.
Define and Reduce the Scope
Map the flow of CUI through people, systems, applications, vendors, and facilities. Where practical, create a controlled enclave that limits the number of assets and users included in the assessment boundary.
Perform a Detailed Gap Assessment
Evaluate each applicable security requirement against actual implementation. Record the evidence supporting every conclusion and distinguish between fully implemented controls, partial implementation, and planned work.
Build or Update the System Security Plan
The SSP should accurately describe the system boundary, operating environment, security controls, connections, roles, and implementation of requirements. It should match the live environment rather than a future-state design.
Remediate Technical and Operational Gaps
Remediation may involve identity management, multifactor authentication, logging, endpoint protection, vulnerability management, encryption, backups, access reviews, incident response, personnel security, physical protection, or vendor management.
Test the Program
Conduct interviews, evidence reviews, and practice assessment activities. Confirm that employees can explain how required processes work and that documentation agrees with technical reality.
Maintain Compliance After the Assessment
Compliance is not finished when an assessment ends. Systems, staff, vendors, contracts, and threats change. Continuous monitoring, annual affirmations when required, recurring training, policy reviews, access reviews, vulnerability remediation, and change management are essential.
Common DFARS and CMMC Mistakes
DoD contractors frequently encounter problems when they:
- Assume their managed IT provider is handling compliance without confirming responsibilities
- Submit an SPRS score without adequate supporting evidence
- Use a generic SSP that does not describe the actual environment
- Overlook subcontractor flow-down requirements
- Store CUI in an unsuitable commercial cloud environment
- Treat written policies as proof that controls are operating
- Include too many systems in the CUI boundary
- Wait for an RFP before beginning remediation
- Confuse a DFARS Basic Assessment with a CMMC certification assessment
- Stop compliance work because a CMMC implementation milestone changes
Avoiding these mistakes requires both cybersecurity knowledge and an understanding of defense contracting requirements.
Frequently Asked Questions
Is DFARS 7012 the same as CMMC?
No. DFARS 7012 establishes safeguarding, incident-reporting, cloud, forensic, and flow-down obligations. CMMC provides an assessment framework used to verify applicable cybersecurity requirements.
Does DFARS 7019 require a CMMC assessment?
Not by itself. DFARS 7019 focuses on having a current NIST SP 800-171 DoD Assessment and posting its summary score in SPRS when applicable. A separate contract requirement may require a particular CMMC status.
How often does a DFARS 7019 assessment expire?
The current provision generally defines an assessment as current when it is no more than three years old, unless the solicitation requires a shorter period.
Does every Level 2 contractor need a C3PAO assessment?
Not necessarily. The CMMC program provides for both Level 2 self-assessment and Level 2 C3PAO assessment statuses. The solicitation and sensitivity of the information determine the required status. Current implementation guidance should be checked because the Phase II transition was suspended in July 2026.
Is CMMC Level 2 compliance a one-time project?
No. Contractors must maintain security as systems, employees, vendors, and threats change. Applicable contracts may also require annual affirmations of continuous compliance and a current CMMC status.
Are COTS suppliers exempt?
Certain clauses contain exceptions for acquisitions exclusively involving commercially available off-the-shelf items. Do not assume the exception applies to the entire business or every contract without reviewing the solicitation, contract, information handled, and work performed.
Get Help With DFARS and CMMC Compliance
DFARS and CMMC preparation can feel overwhelming, especially when contract deadlines are approaching or your organization does not have an internal compliance team.
CMMC IT Support helps DoD contractors and subcontractors understand their obligations, assess their current environment, organize evidence, plan remediation, and prepare for CMMC Level 2 requirements.
Our team can assist with:
- DFARS and NIST SP 800-171 readiness reviews
- CUI scoping and data-flow analysis
- SPRS assessment preparation
- System Security Plans
- Policies and procedures
- Microsoft 365 and Azure security
- Technical remediation planning
- CMMC assessment preparation
- Ongoing compliance and cybersecurity support
Do not wait until a prime contractor sends a questionnaire or a solicitation requires a current assessment.
Request a quote or schedule your free compliance call today.
You can also call 858-483-8770 or email info@cmmcitsupport.us to speak with CMMC IT Support.