Summary and dates.
Origin
Why it still matters under CMMC
DFARS 252.204-7012 is the contract clause that obligates safeguarding of covered defense information (a subset of CUI) and incident reporting. CMMC is the verification mechanism that DoD applies on top of that clause. The two are complementary, not substitutes.
Companion DFARS clauses
DFARS 252.204-7019 (NIST SP 800-171 DoD Assessment Requirements) and DFARS 252.204-7020 (related notice provisions) work alongside -7012 to require contractors to post Supplier Performance Risk System (SPRS) scores under specified conditions.
Sources and citations.
- Acquisition.gov — DFARS 252.204-7012
- Acquisition.gov — DFARS 252.204-7019
- Acquisition.gov — DFARS 252.204-7020
- DoD CIO — CMMC program page
DBIT Defense does not interpret control intent or republish substantive control text. All claims above link to primary sources for verification.
Related insights.
CMMC 2.0 Final Rule: timeline and structure
The CMMC 2.0 Program rule (32 CFR Part 170) was published in the Federal Register in October 2024 and took effect in December 2024. The dates and document struc…
CMMC phased rollout: Phase 1 through Phase 4
DoD has published a four-phase rollout schedule for CMMC, beginning when the DFARS implementation rule becomes effective and ramping over three years. The phase…
The C3PAO ecosystem: who they are, where they are
Authorized CMMC Third Party Assessment Organizations (C3PAOs) conduct Level 2 certification assessments. The Cyber-AB maintains the authoritative marketplace li…
NIST SP 800-171: Rev. 2 vs Rev. 3
NIST published Revision 3 of SP 800-171 in May 2024. The CMMC Program rule (32 CFR Part 170) currently references Revision 2 as the underlying control catalog. …