# DFARS 7012 Self Assessment: 252.204-7012 Compliance Check > Source: https://netray.co/tools/dfars-compliance-self-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### Have you identified which contracts include DFARS 252.204-7012 and what Covered Defense Information (CDI) you receive or generate under them? **Options:** ##### We have not reviewed our contracts for the clause **Score:** 0 ##### We know some contracts include it but have not mapped CDI **Score:** 1 ##### Clause identified in all contracts; CDI partially mapped **Score:** 2 ##### Full contract review complete with a maintained CDI inventory **Score:** 3 #### Have you implemented the 110 security controls of NIST SP 800-171 on covered contractor information systems? **Options:** ##### Not started or unaware of the requirement **Score:** 0 ##### Fewer than half the controls implemented **Score:** 1 ##### Most controls implemented with a POA&M for the rest **Score:** 2 ##### All 110 controls implemented or formally covered by an approved alternative **Score:** 3 #### Is your NIST 800-171 self-assessment score current in SPRS, and does it honestly reflect your environment? **Help:** DFARS 252.204-7019/7020 require a current SPRS score before award. DOJ has pursued False Claims Act cases over inflated scores. **Options:** ##### No score submitted to SPRS **Score:** 0 ##### Score submitted once, now stale or of doubtful accuracy **Score:** 1 ##### Current score submitted, methodology loosely documented **Score:** 2 ##### Current, evidence-backed score with a maintained POA&M and reassessment cadence **Score:** 3 #### Do you have a documented System Security Plan (SSP) and Plans of Action (POA&M) for unimplemented controls? **Options:** ##### Neither exists **Score:** 0 ##### Draft SSP only, no POA&M **Score:** 1 ##### SSP and POA&M exist but are not actively maintained **Score:** 2 ##### Both current, reviewed at least annually, with remediation dates tracked **Score:** 3 #### Could you report a cyber incident to DoD via DIBNet within 72 hours of discovery, as the clause requires? **Help:** Reporting requires a DoD-approved Medium Assurance Certificate, which takes time to obtain - you cannot get one mid-incident. **Options:** ##### Unaware of the 72-hour requirement **Score:** 0 ##### Aware, but no DIBNet access or defined process **Score:** 1 ##### Medium Assurance Certificate obtained; process documented but untested **Score:** 2 ##### Certificate in place and reporting rehearsed in incident response exercises **Score:** 3 #### Are you prepared to preserve images and forensic data for at least 90 days after a reported incident and support DoD damage assessment? **Options:** ##### No forensic preservation capability **Score:** 0 ##### Ad hoc - we would figure it out during an incident **Score:** 1 ##### Documented preservation procedure, limited tooling **Score:** 2 ##### Tested capability to capture and retain images, logs, and malware samples for 90+ days **Score:** 3 #### If you use cloud services to store or process CDI, do they meet FedRAMP Moderate baseline or equivalency? **Options:** ##### CDI is in commercial cloud services with unknown status **Score:** 0 ##### Some services verified, others unreviewed **Score:** 1 ##### All CDI cloud services identified; most verified FedRAMP Moderate or equivalent **Score:** 2 ##### All CDI cloud services verified with documented equivalency evidence, or CDI kept on-prem **Score:** 3 #### Do you flow down DFARS 252.204-7012 to subcontractors who receive CDI, and verify their compliance? **Options:** ##### No flowdown in subcontracts **Score:** 0 ##### Clause flowed down inconsistently, no verification **Score:** 1 ##### Consistent flowdown; verification limited to certifications **Score:** 2 ##### Flowdown plus verification of SPRS scores or questionnaires for CDI-handling subs **Score:** 3 #### Would your team recognize and escalate a reportable cyber incident affecting CDI or your covered systems? **Options:** ##### No incident definitions or escalation path **Score:** 0 ##### IT would handle it, but 'reportable' is undefined **Score:** 1 ##### Incident categories defined; escalation documented **Score:** 2 ##### Defined, trained, and exercised - including the contracts team notifying primes and DoD **Score:** 3 #### Is malicious software discovered during a CDI incident handled per the clause (submitted to DoD Cyber Crime Center, not just deleted)? **Options:** ##### We would delete it and move on **Score:** 0 ##### Unaware of the malware submission requirement **Score:** 1 ##### Requirement documented in our IR plan **Score:** 2 ##### Documented, with tooling and chain-of-custody procedures to capture and submit samples **Score:** 3 **Bands:** #### Non-Compliant - Contractual and Legal Exposure **Min:** 0 **Max:** 39 **Verdict:** You are likely in breach of a clause you have already accepted in signed contracts, which is materially different from being unready for a future requirement. This creates False Claims Act exposure, termination risk, and prime supplier scorecard damage. **Recommendations:** - Review all active contracts and purchase orders for the 7012 clause this week - flowdown from primes counts - Map where CDI enters, lives, and leaves your environment, including ERP, email, and shop floor - Perform an honest NIST 800-171 self-assessment and submit the score to SPRS with a POA&M - Obtain a DoD Medium Assurance Certificate now so incident reporting is possible later - Engage counsel if you have previously certified compliance you did not have #### Partially Compliant - Close the Operational Gaps **Min:** 40 **Max:** 69 **Verdict:** You have addressed the paperwork layer but operational readiness - incident response, forensic preservation, cloud verification, and flowdown enforcement - remains incomplete. These are the elements tested when something actually goes wrong. **Recommendations:** - Rehearse the full 72-hour reporting sequence in a tabletop exercise, including DIBNet submission steps - Verify FedRAMP Moderate equivalency evidence for every cloud service touching CDI - vendor marketing claims are not evidence - Close your highest-weight POA&M items; SPRS scoring penalizes MFA and FIPS gaps most heavily - Implement forensic preservation tooling and a 90-day retention procedure - Audit subcontractor flowdown and collect SPRS scores from CDI-handling subs #### Substantially Compliant - Maintain and Leverage **Min:** 70 **Max:** 100 **Verdict:** Your DFARS 7012 program is in good shape and positions you well for CMMC Level 2, which certifies essentially the same controls. The remaining work is keeping compliance current as your environment and contracts change. **Recommendations:** - Reassess and refresh your SPRS score at least annually and after major system changes - Treat CMMC Level 2 preparation as the natural next step - your 7012 work covers most of it - Extend monitoring to configuration drift so implemented controls stay implemented - Formalize subcontractor verification into your supplier quality process - Use your compliance posture in capture efforts - primes prefer subs who reduce their risk ## Content **Intro:** This free DFARS 252.204-7012 self-assessment helps defense contractors and subcontractors measure compliance with the cybersecurity clause already embedded in most DoD contracts and flowdowns. Ten questions cover the clause's full scope - identifying Covered Defense Information, implementing NIST SP 800-171, maintaining an accurate SPRS score, 72-hour incident reporting through DIBNet, forensic preservation, FedRAMP Moderate cloud equivalency, and subcontractor flowdown. Unlike CMMC, which is phasing in, DFARS 7012 is a current contractual obligation: if the clause is in your contracts and you are not compliant, you are already exposed. Find out where you stand in five minutes. **Sections:** #### How the assessment maps to the clause **Body:** Each question tracks a distinct obligation within 252.204-7012 and its companion clauses 7019 and 7020, scored 0-3 from absent to implemented-and-exercised. The weighting reflects enforcement reality: adequate security (NIST 800-171 implementation and an honest SPRS score) and incident reporting readiness carry the most practical risk, because those are the obligations tested by primes at award time and by DoD when a breach occurs. Questions on forensic preservation, malware submission, and cloud equivalency catch the lesser-known sub-requirements that even well-run programs miss. Your percentage score maps to three bands calibrated to the difference between paperwork compliance and operational compliance - the gap where most contractors actually sit. #### Benchmarks and enforcement context **Body:** Calibrate your result against what is known about the defense supply base and how the government is enforcing the clause: **Bullets:** - DoD's own reviews have found that a large majority of contractors with self-attested high SPRS scores could not substantiate them under assessment - The average DIB self-assessment score before remediation is negative on the -203 to 110 SPRS scale - DOJ's Civil Cyber-Fraud Initiative has settled multiple False Claims Act cases over misrepresented cybersecurity compliance, with penalties in the millions - A DoD Medium Assurance Certificate for DIBNet reporting typically takes days to weeks to obtain - it cannot be acquired reactively mid-incident #### What to do with your score **Body:** A low score demands contract review before technical work: confirm which agreements carry the clause, because your obligations and your exposure flow from signed paper, not from generic best practice. Mid-range scores usually indicate a program that looks compliant in documents but has never been exercised - the fix is rehearsal, verification, and evidence, not more policy writing. Run a tabletop that walks from detection through DIBNet submission within 72 hours; pull equivalency documentation for every cloud vendor touching CDI; and check that your SPRS score would survive a DIBCAC assessment, because under CMMC those assessments become routine. High scorers should pivot their effort toward CMMC Level 2 certification, which formalizes the same 110 controls with third-party verification. #### How Netray helps you operationalize DFARS 7012 **Body:** CDI at a manufacturer concentrates in the ERP layer - part masters, routings, drawings on jobs, and customer-furnished data in SyteLine, LN, or Baan - which generic IT security programs consistently overlook. Netray brings ERP-native compliance engineering: we map CDI flows through your actual business processes, implement the 800-171 controls that touch ERP (access control, audit logging, FIPS encryption, media protection), build your SSP and POA&M around evidence rather than aspiration, and architect on-prem or GovCloud environments where equivalency is provable. Our on-prem AI practice means you can adopt modern AI tooling for quoting, planning, and quality without pushing CDI into non-compliant services. **Cta:** Take the self-assessment now and see exactly which DFARS 7012 obligations you can and cannot currently meet. **Faq:** #### How do I do a DFARS 7012 self assessment? **Answer:** List the contracts that carry DFARS 252.204-7012 and the Covered Defense Information you handle. Then assess your systems against the 110 NIST SP 800-171 controls using the DoD Assessment Methodology, which starts from a score of 110 and subtracts weighted points for each unimplemented control. Document the result in a System Security Plan and a POA&M, and submit the score to SPRS as DFARS 252.204-7019 and 7020 require. This 10-question check covers those steps plus 72-hour incident reporting, cloud equivalency and flowdown, so you can see where the gaps are before a formal assessment. #### What is the difference between DFARS 7012 compliance and CMMC? **Answer:** DFARS 252.204-7012 is a contract clause in force today: it requires you to implement NIST SP 800-171, report incidents within 72 hours, and meet cloud and flowdown obligations, all on a self-attestation basis backed by your SPRS score. CMMC adds third-party verification of essentially the same controls. Think of 7012 as the requirement and CMMC Level 2 as the audit. If you are genuinely 7012-compliant, CMMC preparation is largely evidence organization rather than new controls. #### We are a small subcontractor and never signed a DoD contract directly. Does 7012 apply to us? **Answer:** Very likely yes, through flowdown. Primes and higher-tier subs are required to flow the clause down to any subcontractor whose performance involves Covered Defense Information, and it appears in purchase order terms and supplier quality agreements that many small shops accept without reading. Check your POs and long-term agreements for references to DFARS 252.204-7012, 7019, or 7020. If you receive drawings or specs marked as export-controlled or CUI, assume the clause applies until proven otherwise. #### What counts as a reportable cyber incident under the clause? **Answer:** A reportable incident is one that affects Covered Defense Information, the covered contractor information system it lives on, or your ability to perform operationally critical support. That is broader than data theft - ransomware that locks your ERP, a compromised engineering workstation, or unauthorized access to a file server holding CDI all qualify. When in doubt, the clause's structure favors reporting: you have 72 hours from discovery, and under-reporting carries far more risk than over-reporting. ## Search terms dfars 252.204-7012 compliance, dfars 7012 self assessment, nist 800-171 sprs score, covered defense information cdi, dfars incident reporting 72 hours, dfars flowdown subcontractors, fedramp moderate equivalency --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json