Compliance & ContractsFree referencePDF, Excel, Word exportAerospace & Defense

DFARS and FAR Cyber, Counterfeit Parts and Sourcing Clause Reference

Defense purchase orders arrive with long lists of FAR and DFARS clauses that buyers and quality teams are expected to understand. This reference lists the cyber, counterfeit part, export and sourcing clauses you will see most and what each asks of a supplier.

Download:

Clause	Clause or provision	Title	Topic	What a supplier typically has to do
FAR 52.204-21	Clause	Basic Safeguarding of Covered Contractor Information Systems	FCI safeguarding	Apply the 15 basic safeguarding requirements to systems holding Federal Contract Information
DFARS 252.204-7012	Clause	Safeguarding Covered Defense Information and Cyber Incident Reporting	CDI and incident reporting	Implement NIST SP 800-171, report cyber incidents within 72 hours, preserve images, flow down
DFARS 252.204-7008	Provision	Compliance with Safeguarding Covered Defense Information Controls	Offeror representation	Represent that you will implement the required controls when submitting an offer
DFARS 252.204-7009	Clause	Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information	Incident data handling	Use incident information only for the permitted purpose and protect it
DFARS 252.204-7019	Provision	Notice of NIST SP 800-171 DoD Assessment Requirements	SPRS score	Have a current assessment posted in SPRS before award
DFARS 252.204-7020	Clause	NIST SP 800-171 DoD Assessment Requirements	DoD assessments	Provide access for Medium and High assessments, flow down to subcontractors
DFARS 252.204-7021	Clause	Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement	CMMC	Hold the required CMMC level for the contract and for subcontractors handling the same information
DFARS 252.204-7000	Clause	Disclosure of Information	Public release	Do not release unclassified contract information to the public without approval
DFARS 252.204-7018	Clause	Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services	Telecom prohibitions	Do not provide covered equipment or services, review your own supply chain
FAR 52.204-25	Clause	Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment	Section 889	Do not use or deliver covered telecom or video surveillance items, report discoveries
DFARS 252.225-7048	Clause	Export-Controlled Items	Export compliance	Comply with ITAR and EAR requirements applicable to the work
DFARS 252.239-7010	Clause	Cloud Computing Services	Cloud hosting	Use cloud services that meet DoD requirements when the contract involves them
DFARS 252.246-7007	Clause	Contractor Counterfeit Electronic Part Detection and Avoidance System	Counterfeit parts	Maintain a counterfeit detection and avoidance system meeting the clause criteria
DFARS 252.246-7008	Clause	Sources of Electronic Parts	Electronic part sourcing	Buy from original manufacturers or authorized suppliers, or follow trusted supplier rules
FAR 52.246-26	Clause	Reporting Nonconforming Items	Nonconforming items	Report counterfeit or suspect counterfeit and major or critical nonconformances
DFARS 252.246-7003	Clause	Notification of Potential Safety Issues	Safety	Notify the contracting officer of safety issues in critical safety items
DFARS 252.225-7009	Clause	Restriction on Acquisition of Certain Articles Containing Specialty Metals	Specialty metals	Deliver items whose specialty metals were melted or produced in qualifying countries
DFARS 252.225-7052	Clause	Restriction on the Acquisition of Certain Magnets, Tantalum, and Tungsten	Magnets, tantalum, tungsten	Avoid covered materials mined, refined or produced in covered countries
DFARS 252.225-7001	Clause	Buy American and Balance of Payments Program	Domestic preference	Deliver domestic end products unless an exception applies
DFARS 252.211-7003	Clause	Item Unique Identification and Valuation	IUID marking	Mark qualifying items with a unique item identifier and register as required
DFARS 252.227-7013	Clause	Rights in Technical Data - Other Than Commercial Products and Commercial Services	Data rights	Mark technical data deliverables with the correct restrictive legends
DFARS 252.227-7014	Clause	Rights in Other Than Commercial Computer Software and Other Than Commercial Computer Software Documentation	Software rights	Mark software deliverables and track development funding
DFARS 252.244-7000	Clause	Subcontracts for Commercial Products or Commercial Services	Flowdown rule	Flow down only the clauses that actually apply to commercial subcontracts

Clause numbers and titles change with DFARS and FAR updates, and contracts incorporate specific clause dates. Always read the clause text in your contract and the current acquisition regulation. This table is a navigation aid, not legal advice.

Automate PO clause review

Optional: a short scoping call on reading clauses from PO text in your ERP and routing them to owners, running on your own servers.

Optional. The tool and every export work without this. No spam.

How to use the table

Search by clause number from your PO, such as 252.204-7012, or by topic such as counterfeit or specialty metals. Check whether the entry is a clause, which becomes part of the contract, or a provision, which applies at the solicitation stage. Then read the action column to decide who owns it internally. Export the filtered rows to Excel and add owner and evidence columns to turn it into a PO review log.

The 7012, 7019, 7020, 7021 family

These four clauses work together. 252.204-7012 requires NIST SP 800-171 controls and 72 hour incident reporting for covered defense information. 252.204-7019 and 7020 require a current DoD assessment score in SPRS and give the government assessment access. 252.204-7021 adds the CMMC level requirement. The practical effect is that being awarded work depends on a posted score or certification, and the same obligations pass to subcontractors who handle the same information.

7012: controls plus cyber incident reporting
7019 and 7020: SPRS score and DoD assessment
7021: CMMC level compliance

Counterfeit parts and sourcing

DFARS 252.246-7007 and 252.246-7008 matter most to electronics and assembly shops. They expect documented procedures for detecting counterfeit parts, traceability to original manufacturers or authorized distributors, and reporting of suspect items. In an ERP this becomes approved source lists, receiving inspection plans by commodity and lot traceability. Sourcing clauses such as specialty metals add certificate and melt-origin checks to material receiving.

Common mistakes

The usual errors are flowing down every clause blindly, ignoring clause dates, and assuming a commercial item exemption removes cyber obligations. Another is missing that an offeror representation, such as 252.204-7008, is a legal statement that must match what you can prove. Keep a PO clause log, review it at quote stage and make sure the quality and IT teams see the same list.

Frequently Asked Questions

What is the difference between a clause and a provision?

A provision applies during solicitation and bidding, for example representations in an offer. A clause is incorporated into the awarded contract and governs performance. Many provisions have a matching clause, such as 252.204-7019 and 252.204-7020.

Does 252.204-7012 apply to commercial items?

The clause can apply to contracts for commercial products and services when covered defense information is involved. Do not assume an exemption. Check the clause text in your contract and the guidance for your situation, and ask your contracting counsel if unclear.

Do I flow these clauses down to my suppliers?

Several of them require flowdown when a subcontractor will handle the relevant information or items, including 252.204-7012 and 252.204-7020. Flow down based on the clause text and the work performed, not as a blanket rule. Keep records of what you flowed to whom.

How current is this list?

It reflects clauses commonly seen on defense POs at the time of writing. Regulations change, including titles and numbering after the move from commercial item to commercial product language. Always verify against the current DFARS and FAR and the dated clauses in your contract.

If clause review is manual today, we can build a private tool that reads PO text from your ERP and flags the clauses above for the right owner. The reference stands on its own.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools