# DFARS and FAR Cyber, Counterfeit Parts and Sourcing Clause Reference > Source: https://netray.co/tools/dfars-far-cyber-and-supply-chain-clause-reference > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A lookup of the DFARS and FAR clauses that appear on defense purchase orders, what each covers and what a supplier has to do about it. ## Category compliance-legal ## Industry Aerospace & Defense ## Audience - Contracts manager - Buyer - Supplier quality - Compliance manager ## Tool **Kind:** worksheet **Mode:** reference **Columns:** #### Clause **Key:** clause **Type:** text #### Clause or provision **Key:** kind **Type:** text #### Title **Key:** title **Type:** text #### Topic **Key:** topic **Type:** text #### What a supplier typically has to do **Key:** action **Type:** text **Rows:** #### Basic Safeguarding of Covered Contractor Information Systems **Clause:** FAR 52.204-21 **Kind:** Clause **Topic:** FCI safeguarding **Action:** Apply the 15 basic safeguarding requirements to systems holding Federal Contract Information #### Safeguarding Covered Defense Information and Cyber Incident Reporting **Clause:** DFARS 252.204-7012 **Kind:** Clause **Topic:** CDI and incident reporting **Action:** Implement NIST SP 800-171, report cyber incidents within 72 hours, preserve images, flow down #### Compliance with Safeguarding Covered Defense Information Controls **Clause:** DFARS 252.204-7008 **Kind:** Provision **Topic:** Offeror representation **Action:** Represent that you will implement the required controls when submitting an offer #### Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information **Clause:** DFARS 252.204-7009 **Kind:** Clause **Topic:** Incident data handling **Action:** Use incident information only for the permitted purpose and protect it #### Notice of NIST SP 800-171 DoD Assessment Requirements **Clause:** DFARS 252.204-7019 **Kind:** Provision **Topic:** SPRS score **Action:** Have a current assessment posted in SPRS before award #### NIST SP 800-171 DoD Assessment Requirements **Clause:** DFARS 252.204-7020 **Kind:** Clause **Topic:** DoD assessments **Action:** Provide access for Medium and High assessments, flow down to subcontractors #### Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement **Clause:** DFARS 252.204-7021 **Kind:** Clause **Topic:** CMMC **Action:** Hold the required CMMC level for the contract and for subcontractors handling the same information #### Disclosure of Information **Clause:** DFARS 252.204-7000 **Kind:** Clause **Topic:** Public release **Action:** Do not release unclassified contract information to the public without approval #### Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services **Clause:** DFARS 252.204-7018 **Kind:** Clause **Topic:** Telecom prohibitions **Action:** Do not provide covered equipment or services, review your own supply chain #### Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment **Clause:** FAR 52.204-25 **Kind:** Clause **Topic:** Section 889 **Action:** Do not use or deliver covered telecom or video surveillance items, report discoveries #### Export-Controlled Items **Clause:** DFARS 252.225-7048 **Kind:** Clause **Topic:** Export compliance **Action:** Comply with ITAR and EAR requirements applicable to the work #### Cloud Computing Services **Clause:** DFARS 252.239-7010 **Kind:** Clause **Topic:** Cloud hosting **Action:** Use cloud services that meet DoD requirements when the contract involves them #### Contractor Counterfeit Electronic Part Detection and Avoidance System **Clause:** DFARS 252.246-7007 **Kind:** Clause **Topic:** Counterfeit parts **Action:** Maintain a counterfeit detection and avoidance system meeting the clause criteria #### Sources of Electronic Parts **Clause:** DFARS 252.246-7008 **Kind:** Clause **Topic:** Electronic part sourcing **Action:** Buy from original manufacturers or authorized suppliers, or follow trusted supplier rules #### Reporting Nonconforming Items **Clause:** FAR 52.246-26 **Kind:** Clause **Topic:** Nonconforming items **Action:** Report counterfeit or suspect counterfeit and major or critical nonconformances #### Notification of Potential Safety Issues **Clause:** DFARS 252.246-7003 **Kind:** Clause **Topic:** Safety **Action:** Notify the contracting officer of safety issues in critical safety items #### Restriction on Acquisition of Certain Articles Containing Specialty Metals **Clause:** DFARS 252.225-7009 **Kind:** Clause **Topic:** Specialty metals **Action:** Deliver items whose specialty metals were melted or produced in qualifying countries #### Restriction on the Acquisition of Certain Magnets, Tantalum, and Tungsten **Clause:** DFARS 252.225-7052 **Kind:** Clause **Topic:** Magnets, tantalum, tungsten **Action:** Avoid covered materials mined, refined or produced in covered countries #### Buy American and Balance of Payments Program **Clause:** DFARS 252.225-7001 **Kind:** Clause **Topic:** Domestic preference **Action:** Deliver domestic end products unless an exception applies #### Item Unique Identification and Valuation **Clause:** DFARS 252.211-7003 **Kind:** Clause **Topic:** IUID marking **Action:** Mark qualifying items with a unique item identifier and register as required #### Rights in Technical Data - Other Than Commercial Products and Commercial Services **Clause:** DFARS 252.227-7013 **Kind:** Clause **Topic:** Data rights **Action:** Mark technical data deliverables with the correct restrictive legends #### Rights in Other Than Commercial Computer Software and Other Than Commercial Computer Software Documentation **Clause:** DFARS 252.227-7014 **Kind:** Clause **Topic:** Software rights **Action:** Mark software deliverables and track development funding #### Subcontracts for Commercial Products or Commercial Services **Clause:** DFARS 252.244-7000 **Kind:** Clause **Topic:** Flowdown rule **Action:** Flow down only the clauses that actually apply to commercial subcontracts **Notes:** Clause numbers and titles change with DFARS and FAR updates, and contracts incorporate specific clause dates. Always read the clause text in your contract and the current acquisition regulation. This table is a navigation aid, not legal advice. ## Content **Intro:** Defense purchase orders arrive with long lists of FAR and DFARS clauses that buyers and quality teams are expected to understand. This reference lists the cyber, counterfeit part, export and sourcing clauses you will see most and what each asks of a supplier. **Sections:** #### How to use the table **Body:** Search by clause number from your PO, such as 252.204-7012, or by topic such as counterfeit or specialty metals. Check whether the entry is a clause, which becomes part of the contract, or a provision, which applies at the solicitation stage. Then read the action column to decide who owns it internally. Export the filtered rows to Excel and add owner and evidence columns to turn it into a PO review log. #### The 7012, 7019, 7020, 7021 family **Body:** These four clauses work together. 252.204-7012 requires NIST SP 800-171 controls and 72 hour incident reporting for covered defense information. 252.204-7019 and 7020 require a current DoD assessment score in SPRS and give the government assessment access. 252.204-7021 adds the CMMC level requirement. The practical effect is that being awarded work depends on a posted score or certification, and the same obligations pass to subcontractors who handle the same information. **Bullets:** - 7012: controls plus cyber incident reporting - 7019 and 7020: SPRS score and DoD assessment - 7021: CMMC level compliance #### Counterfeit parts and sourcing **Body:** DFARS 252.246-7007 and 252.246-7008 matter most to electronics and assembly shops. They expect documented procedures for detecting counterfeit parts, traceability to original manufacturers or authorized distributors, and reporting of suspect items. In an ERP this becomes approved source lists, receiving inspection plans by commodity and lot traceability. Sourcing clauses such as specialty metals add certificate and melt-origin checks to material receiving. #### Common mistakes **Body:** The usual errors are flowing down every clause blindly, ignoring clause dates, and assuming a commercial item exemption removes cyber obligations. Another is missing that an offeror representation, such as 252.204-7008, is a legal statement that must match what you can prove. Keep a PO clause log, review it at quote stage and make sure the quality and IT teams see the same list. **Cta:** If clause review is manual today, we can build a private tool that reads PO text from your ERP and flags the clauses above for the right owner. The reference stands on its own. **Faq:** #### What is the difference between a clause and a provision? **Answer:** A provision applies during solicitation and bidding, for example representations in an offer. A clause is incorporated into the awarded contract and governs performance. Many provisions have a matching clause, such as 252.204-7019 and 252.204-7020. #### Does 252.204-7012 apply to commercial items? **Answer:** The clause can apply to contracts for commercial products and services when covered defense information is involved. Do not assume an exemption. Check the clause text in your contract and the guidance for your situation, and ask your contracting counsel if unclear. #### Do I flow these clauses down to my suppliers? **Answer:** Several of them require flowdown when a subcontractor will handle the relevant information or items, including 252.204-7012 and 252.204-7020. Flow down based on the clause text and the work performed, not as a blanket rule. Keep records of what you flowed to whom. #### How current is this list? **Answer:** It reflects clauses commonly seen on defense POs at the time of writing. Regulations change, including titles and numbering after the move from commercial item to commercial product language. Always verify against the current DFARS and FAR and the dated clauses in your contract. ## Search terms dfars 252.204-7012 meaning, dfars 252.204-7019 7020, dfars 252.204-7021 cmmc clause, far 52.204-21 basic safeguarding, dfars clauses list purchase order, dfars 252.246-7007 counterfeit parts, dfars flowdown clauses, dfars 252.225-7048 export controlled items --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json