United StatesSafeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012)
In force since .
A vulnerability and incident reporting rule binding private bodies.
What it requires
- This clause reaches your organization only if it is a contractor or subcontractor performing a Department of Defense contract or subcontract whose information system processes, stores, or transmits covered defense information, or whose contract designates operationally critical support; no declared activity in this checklist stands in for that status, so read this instrument by hand if your organization holds a Department of Defense contract or subcontract.
- If this clause applies to your organization, provide adequate security on every covered contractor information system, implementing the security requirements of National Institute of Standards and Technology (NIST) Special Publication 800-171 unless the system is part of an information technology service the government operates on its own behalf, in which case follow the security requirements stated elsewhere in the contract.NIST CSF 2.0GV.OC-03
- Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.NIST CSF 2.0RS.CO-02
- Preserve and protect forensic images of the affected information systems and related monitoring and packet-capture data for at least 90 days counted from the date you submit the cyber incident report, not from the date you discovered the incident, so the Department of Defense can request the media or decline interest.NIST CSF 2.0RS.AN-07
- Submit any malicious software you isolate in connection with a reported incident to the Department of Defense Cyber Crime Center, following that Center's instructions, and never send it to the contracting officer.NIST CSF 2.0RS.CO-03
- Include this clause, unaltered except to identify the parties, in every subcontract or similar contractual instrument that involves covered defense information or operationally critical support, including a subcontract for a commercial product or service.NIST CSF 2.0GV.SC-05
- Where an external cloud service provider stores, processes, or transmits covered defense information for you, require that provider by contract to meet security requirements equivalent to the FedRAMP Moderate baseline and to carry out the same incident reporting, malicious software, media preservation, forensic access, and damage assessment duties this clause places on you.NIST CSF 2.0GV.SC-05
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- RS.AN-07Incident data and metadata are collected, and their integrity and provenance are preserved
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
The clause requires a contractor to provide adequate security on every covered contractor information system that processes, stores, or transmits covered defense information. For a system that is not part of an information technology service the government operates on its own behalf, that duty means implementing the safeguards in National Institute of Standards and Technology (NIST) Special Publication 800-171. The contractor must rapidly report a cyber incident, defined as reporting within 72 hours of discovery of the incident.
That report is made to the Department of Defense at its DIBNet portal, dibnet.dod.mil. Filing that report requires a DoD-approved medium assurance certificate. The contractor must preserve and protect forensic images of the affected information systems and related monitoring and packet-capture data for at least 90 days from the date it submits the cyber incident report.
Malicious software isolated in connection with a reported incident must be submitted to the Department of Defense Cyber Crime Center rather than to the contracting officer. The clause must be included without alteration in a subcontract that involves covered defense information or operationally critical support, including a subcontract for a commercial product or service.
A contractor using an external cloud service provider must require that provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with the clause's duties on incident reporting, malicious software, media preservation, forensic access, and damage assessment.
Back to the example · Lint your app
Page updated .