What Triggers the Clause in a Machine Shop
The clause appears in a purchase order or subcontract, but it only bites when covered defense information is in play. Covered defense information is unclassified controlled technical information or other information marked or identified in the contract that requires safeguarding. For a shop, that is typically the drawing set, the CAD model, the specification, test procedures and sometimes the process sheets provided by the prime.
204-7012 and your shop receives that data, you are in scope for those systems. If the part is a pure catalog item with no controlled data, the clause may not apply in practice, but confirm with the prime in writing and keep the answer on file.
The Four Obligations You Have to Plan For
Four commitments sit inside the clause. First, implement NIST SP 800-171 on the covered systems. Second, report cyber incidents that affect covered defense information or your ability to perform the contract within 72 hours via DIBNet, using a medium assurance certificate.
Third, preserve and protect images of affected systems and relevant monitoring data for 90 days. Fourth, use cloud services that process covered data only if they meet FedRAMP Moderate equivalent requirements. A small shop that cannot name who files the report, where the certificate lives and how it images a compromised machine does not yet have an incident response plan that meets the clause.
- Obtain a DoD-approved medium assurance certificate before an incident, not during one
- Name a primary and backup incident reporter
- Keep a tested procedure to image a workstation and preserve logs
- Confirm any cloud provider holding CUI meets the FedRAMP Moderate equivalency requirement
Flow-Down to Your Own Suppliers
The clause requires you to flow it down to subcontractors when performance involves covered defense information. In a shop, that means heat treaters, platers, NDT labs, grinding houses and material service centers that receive drawings or specifications. Many of them are smaller than you and have never assessed against NIST SP 800-171.
You need a vendor list marking which suppliers receive covered data, evidence that the clause is on your purchase orders to them, and a process for confirming their SPRS posting. If you cannot find a compliant supplier for a special process, reduce what they see: send only the process specification, not the full drawing, if the contract and your prime allow it.
Try it here, free
DFARS 252.204-7012 Compliance Self-Assessment
A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
A Sensible Order of Operations
Do not start with tools. Start by inventorying where covered data lives today: email, shared drives, ERP attachments, CNC machines, laptops, backups. Then scope your boundary, write the System Security Plan, run the DoD Assessment Methodology self-score, and post your score to SPRS.
Fix identity and access first, since multi-factor authentication, account hygiene and logging cover many practices at once. Next, tackle media protection and removable-drive rules for the shop floor. Finally, rehearse an incident, from detection through the 72-hour report, so the first time is not the real one.
Assign owners and dates for each gap in the POA&M.
When to Get Outside Help
A shop with in-house IT can often handle the technical controls but still benefits from an independent gap assessment, because blind spots in scoping are the most common failing. A shop with no IT staff should weigh a managed provider that operates a compliant enclave against building one itself. Whatever you choose, ownership of the System Security Plan and the SPRS affirmation stays with an executive of your company, and an inaccurate score can carry False Claims Act exposure.
The cost of getting that statement right is small compared with the contract value at risk.
Frequently asked questions
What is the 72-hour reporting requirement in DFARS 7012?
When you discover a cyber incident affecting covered defense information or your ability to perform operationally critical support, you must rapidly report it to DoD, within 72 hours of discovery, through the DIBNet portal using a medium assurance certificate. You also need to submit malware to the DoD Cyber Crime Center if found.
Does DFARS 252.204-7012 apply to a shop that only makes commercial parts?
Generally no, unless the contract flows the clause and covered defense information is involved. If no controlled data enters your systems, the safeguarding obligations are not triggered, though the clause on the PO should still be confirmed with your customer. Document your determination.
Is NIST 800-171 compliance the same as CMMC?
No, but they are tightly linked. NIST SP 800-171 defines the 110 security requirements. DFARS 7012 requires you to implement them and self-attest. CMMC adds a verification layer, with third-party assessments for most CUI contracts, so your 800-171 work carries directly into CMMC Level 2.
If your ERP and quoting data sit inside the covered environment, Netray can deploy AI that runs on your own hardware inside the same boundary, with no data leaving your network.