# DFARS 252.204-7012 and NIST 800-171: The Contract Layer Under CMMC > Most defense contractors do not have a CMMC requirement yet. What they have is DFARS 252.204-7012, the clause that has demanded NIST 800-171 compliance and a SPRS score for years, and the CMMC requirement arrives as a new clause phased into new contracts on top of it. Here is the stack as it stands: what 7012 requires today, what it does not, how the SPRS score works, and how to tell which regime your contracts actually trigger. - **Published**: 2026-10-28 - **URL**: https://vendorquals.com/blog/dfars-252-204-7012-nist-800-171 --- # DFARS 252.204-7012 and NIST 800-171: The Contract Layer Under CMMC *Most defense contractors do not have a CMMC requirement yet. What they have is DFARS 252.204-7012, the clause that has demanded NIST 800-171 compliance and a SPRS score for years, and the CMMC requirement arrives as a new clause phased into new contracts on top of it. Here is the stack as it stands: what 7012 requires today, what it does not, how the SPRS score works, and how to tell which regime your contracts actually trigger.* ## Key takeaways - **7012 is the layer that already applies to you.** If your DoD contracts cover covered defense information, DFARS 252.204-7012 already requires NIST 800-171 compliance, a 72-hour incident report to DoD, and media preservation for 90 days. CMMC did not replace it; it stacks on top. - **The SPRS score is the current gate.** DoD requires a current NIST 800-171 self-assessment score posted in the Supplier Performance Risk System (SPRS) for award eligibility where the clause applies. No score, no award. - **CMMC arrives contract by contract, not all at once.** The CMMC clause (DFARS 252.204-7021) phases into new contracts across the program's rollout. Until it appears in your contract language, CMMC certification is not your operative requirement; 7012 plus SPRS is. - **Flow-down is the subcontractor's reality.** Primes flow 7012 (and eventually the CMMC requirement) down to any subcontractor that handles covered defense information. If you never read your prime's flow-down terms, that is where your obligation is hiding. - **The NIST 800-171 revision matters.** The clause pulls the standard in through the companion clause DFARS 252.204-7008, and DoD has been moving the reference forward from Revision 2 to Revision 3. Which revision your contract language invokes changes the control set you answer to; check the clause version in your contracts, not the standard's homepage. ## What 7012 actually says DFARS 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting," does three things in about a page: 1. **It requires NIST 800-171 compliance.** If a contract, task order, or delivery order involves covered defense information, the contractor must implement the security requirements of NIST SP 800-171 (pulled in via DFARS 252.204-7008) on the covered contractor information system. 2. **It sets the incident clock.** A cyber incident that affects covered defense information on the covered system must be reported to DoD within 72 hours of discovery, through the DoD incident channel (DIBNet), with rapid reporting that includes what happened and what covered information was involved. 3. **It demands evidence preservation.** The media associated with the incident must be preserved for 90 days so DoD can request damage-assessment information if it chooses. That 72-hour clock is why incident response retainers and DFARS show up in the same sentence: the clause also makes the incident handling itself part of compliance, not just the security controls. Companies that discover this clause during an incident are companies reporting late. ## The SPRS score: compliance made countable Since the DoD interim rule of 2020, where 7012 applies, contractors must post a self-assessment score for NIST 800-171 in SPRS, the Supplier Performance Risk System, and keep it current. The score is blunt: points for requirements met, deductions for those not met, and the score a contracting officer can see before award. Three practical notes from how the system actually runs: - **The score is self-reported, but it is not free speech.** It has to reflect a real self-assessment against the standard's requirements, and DoD can validate. A generous score is a liability with a delay fuse. - **Negative scores exist.** Companies that never assessed themselves and owe more than they meet can post below zero. It is visible and it is ugly. - **A POA&M story helps, but the number still leads.** The score is the gate; the plan behind it is the explanation. Contracting officers see the number first. ## Where CMMC stacks on top The CMMC program (rule at 32 CFR Part 170) adds a certification requirement on top of the self-attestation world: - **7012 stays.** The safeguarding clause, the 72-hour report, the 90-day preservation: all unchanged by CMMC. - **7021 arrives.** The CMMC clause, DFARS 252.204-7021, names the required CMMC level and assessment type for the contract. It phases into new contracts over the program's rollout rather than applying to everything at once. - **Self-assessment does not retire.** Where 7021 accepts the annual self-assessment for Level 2, the SPRS score remains the record. Where it demands a C3PAO assessment, the certification becomes the record, valid three years. The buyer's rule of thumb: **read your contract language.** If 7021 with a level is in it, CMMC is your operative requirement for that contract. If only 7012 is, then NIST 800-171 compliance, a current SPRS score, and the incident-reporting obligations are what a reviewer will check. The [Level 2 assessment walkthrough here](/blog/cmmc-level-2-assessment) covers the certification side; this page is the layer beneath it. ## Flow-down: how the obligation reaches you 7012 requires primes to flow its requirements down to subcontractors at all tiers that handle covered defense information. In practice this means a subcontractor's CMMC destiny arrives as a clause in a teaming agreement or a PO terms sheet nobody read closely. Two habits catch this early: 1. **Search every DoD contract and flow-down you sign for the clause numbers** (252.204-7012, 252.204-7012 alternate, 252.204-7008, 252.204-7021). They are the markers of the regime that applies. 2. **Ask the prime which CMMC level they expect to flow to your tier, and when.** Primes build their supply-chain requirements ahead of their own contracts; the answer tells you your runway. ## What "covered defense information" means, because everything keys off it The regime only applies where covered defense information (CDI) exists: unclassified technical or other information that requires protection and is marked or otherwise identified in the contract. The practical consequences: - No CDI, no 7012 requirement, and CMMC Level 1 territory at most (Federal Contract Information covers the more basic contract data nearly every DoD vendor handles). - Markings matter. If CUI markings show up in your deliverables or file shares, you are handling CUI and Level 2's scope of work (the 110 practices) is what your contract will eventually demand. - CDI that wanders (email attachments, shared drives, personal devices) quietly expands your real assessment boundary no matter what your contract says. Scoping discipline is cheaper than discovery. ## Frequently asked questions **Is CMMC required now or not?** Contract by contract. The CMMC clause phases into new contract awards; until it is in your contract, the operative requirements are 7012's. Reading the clause list in your current and pipeline contracts is the only reliable answer. **Do I need a C3PAO for my SPRS score?** No. SPRS takes your self-assessment score. A C3PAO is required only where the contract requires the official assessment, and engaging one for preparation support before that is a choice, not a clause. **What is the difference between NIST 800-171 and CMMC Level 2?** Level 2 is the program's assessment regime over the same 110 practices: verification that the 800-171 controls exist, with the rigor depending on who assesses. **Do I still need the 72-hour DoD report if I also report to insurers and regulators?** Yes, and they are different reports to different parties on different clocks. The DoD report goes through the DIBNet channel. The clocks do not substitute for each other; the [state breach notification guide here](/blog/state-breach-notification-laws) covers the civilian side of the stack. **Where do I find firms that do the readiness work?** The C3PAO directory covers the official assessors; readiness help comes from the same firms and from RPOs (Registered Provider Organizations). The [C3PAO directory here](/firms/cmmc-services) documents the assessor layer with evidence attached. [Browse documented CMMC assessment firms ->](https://vendorquals.com/firms/cmmc-services) --- *The clause requirements here reflect DFARS 252.204-7012, its companion clauses, and the CMMC final rule (32 CFR Part 170) as last reviewed, paraphrased with attribution; the Defense Federal Acquisition Regulation changes with the Federal Register, so verify the clause version your contract invokes before relying on this. Last verified: October 2026. Have a correction or addition? [Request inclusion or a correction ->]* Source: https://vendorquals.com/blog/dfars-252-204-7012-nist-800-171. This page is also served as HTML at https://vendorquals.com/blog/dfars-252-204-7012-nist-800-171. --- - [All articles](https://vendorquals.com/blog)