DFARS 252.204-7012, 7019, 7020, and 7021 Explained

Four DFARS clauses dominate defense cyber conversations. They are related but not interchangeable. This page explains each clause’s role at a high level — not a substitute for reading the clause text or consulting counsel.

Related: CMMC hub · 7012 IR / 72-hour · SPRS · Timeline.

Not legal advice: Clause versions and deviations (including CMMC class deviations during Phase II suspension) change. Verify the text in your contract.

Clause Roles at a Glance

Clause

Common name

High-level role

252.204-7012

Safeguarding Covered Defense Information / Cyber Incident Reporting

Implement NIST SP 800-171 safeguarding for covered defense information; report cyber incidents to DoD within 72 hours of discovery; preserve media; support damage assessment

252.204-7019

Notice of NIST SP 800-171 DoD Assessment Requirements

Requires offerors/contractors to be aware of and prepared for DoD assessment requirements; ties to SPRS posting expectations for 800-171 assessment status

252.204-7020

NIST SP 800-171 DoD Assessment Requirements

Operationalizes Basic/Medium/High assessment expectations and government access to systems/records related to 800-171 implementation

252.204-7021

Contractor Compliance with the CMMC Program

Inserts CMMC level requirements into contracts as the programme phases in; current designation practice is affected by Phase II suspension (Self-only designations during the window)

How They Fit Together

7012 is the longstanding safeguarding and incident-reporting engine. 7019/7020 tightened SPRS and assessment visibility for 800-171. 7021 adds the CMMC status requirement as a contract mechanism. Suspension of Phase II changes which CMMC assessment types requiring activities may designate — it does not delete 7012.

How CyberSilo Helps

Map technical evidence to 800-171 / CMMC requirements that 7012 and 7021 assume
SIEM and IR workflows that support the 72-hour reporting capability
Readiness for SPRS-aligned affirmation cycles

Align Controls to the Clause Stack

Use CSA and ThreatHawk so 7012 safeguarding, SPRS-ready assessments, and CMMC evidence tell the same story.

Talk to CyberSilo CMMC Automation

Frequently Asked Questions

Does 7021 replace 7012?

No. 7021 addresses CMMC programme compliance in contracts. 7012 remains the safeguarding and 72-hour cyber incident reporting clause.

What do 7019 and 7020 mainly do?

They notify and require NIST SP 800-171 DoD assessment posture — including SPRS-related expectations and government assessment cooperation.

Did Phase II suspension remove these clauses?

No. Suspension limits which CMMC levels/assessment types requiring activities may designate. 7012 safeguarding and self-assessment obligations continue.

CMMC hub · 72-hour IR · Flow-down · Level 2 · CSA

DFARS 252.204-7012, 7019, 7020, and 7021 Explained

Clause Roles at a Glance

How They Fit Together