If your contract includes 252.204-7012 and your systems touch CUI, you're already on the hook for 110 controls, 72-hour breach reporting, and mandatory flowdowns. Read the clauses correctly before an assessor — or a breach — does it for you.
DoD uses DFARS clauses to push cybersecurity requirements down through the supply chain. When one appears in your contract — or gets flowed down from a prime — you've accepted the obligation, whether you read it or not.
A single contract can include several at once. Your job: read the contract, identify which clauses are present, and map each to its specific obligations.
The big one. Three core obligations: implement all 110 NIST SP 800-171 controls on any system handling CUI; report cyber incidents to DoD within 72 hours via the DIBNet portal and preserve forensic images; and flow the clause down to subcontractors who may handle covered defense information.
Flowdown · MandatoryRequires a current 800-171 self-assessment score on record in SPRS (scale −203 to 110) before award. No current score, no eligibility.
Pre-award gateGives DoD the right to conduct a government-led Medium or High assessment of your implementation — and requires your cooperation. Almost always paired with 7019.
Government assessmentThe CMMC clause itself. Specifies the required level (1, 2, or 3). Most CUI handlers need Level 2, mapping to the 110 controls and requiring a C3PAO third-party assessment. Carries a flowdown requirement.
Flowdown · C3PAOIf you or your subs use cloud to process DoD data, providers must meet FedRAMP Moderate (or equivalent). Direct impact on how you scope your boundary and document services in your SSP.
Scope · SSPThese don't work in isolation — they stack. A single contract can carry 7012, 7019, 7020, and 7021 simultaneously. The full guide maps every clause to its obligations, flowdowns, and the evidence artifacts each one drives.
Each of these is common, avoidable, and exactly what a Medium or High assessor will look for.
The requirement is active the moment you sign and your system touches covered defense information. There's no grace period to "work toward."
Primes use their own templates. The clause may be paraphrased, incorporated by reference, or buried in an attachment. If CUI is involved, assume it applies — and verify.
A score without a dated self-assessment, SSP, and POA&M behind it is a significant finding waiting to happen under 7020.
Too broad pulls in systems that needn't carry 800-171 obligations. Too narrow leaves out systems that legitimately process CUI. Your scope must be documented and defensible.
If your incident response plan doesn't name DIBNet, assign an owner, and define evidence preservation, you'll miss the reporting window under pressure.
The guide pairs each clause with the documentation and evidence that keeps it from becoming a finding.
Get my free guide →A contract-by-clause breakdown of obligations, flowdowns, and evidence requirements — built for the people doing the actual contract work. Inside:
Drop your details and we'll send the full clause-by-clause breakdown straight to your inbox — obligations, flowdowns, and the evidence each clause requires.
