DFARS: Defense Federal Acquisition Regulation Supplement Guide

The DFARS cybersecurity clause (252.204-7012) requires all defense contractors and subcontractors handling Controlled Unclassified Information (CUI) to implement the 110 security controls specified in NIST SP 800-171. The Cybersecurity Maturity Model Certification (CMMC 2.0) program builds on DFARS by adding third-party assessment requirements, making cybersecurity compliance a verified prerequisite for defense contract awards.

What DFARS/CMMC Covers

DFARS 252.204-7012 requires contractors to implement NIST SP 800-171's 110 controls across 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

CMMC 2.0 defines three levels. Level 1 (Foundational) requires 17 basic safeguarding practices for Federal Contract Information (FCI). Level 2 (Advanced) requires all 110 NIST SP 800-171 controls for CUI. Level 3 (Expert) adds controls from NIST SP 800-172 for the most sensitive programs. Contractors must also report cyber incidents to the DoD within 72 hours.

Who Needs DFARS/CMMC Compliance

All DoD contractors and subcontractors handling FCI or CUI must comply. This includes prime contractors, subcontractors at all tiers, and cloud service providers hosting defense data. The defense industrial base includes over 300,000 companies, many of them small and medium-sized businesses. CMMC 2.0 is being phased into all DoD contracts, making compliance a prerequisite for continuing to do defense business.

Implementation Approach

Conduct a gap assessment against NIST SP 800-171 controls. Develop a System Security Plan (SSP) documenting your control implementation. Create a Plan of Action and Milestones (POA&M) for any gaps. Implement required controls — key areas include multi-factor authentication, encryption of CUI, audit logging, incident response, and access management. For CMMC Level 2, prepare for third-party assessment by a CMMC Third Party Assessment Organization (C3PAO).

Cost Considerations

CMMC Level 1 compliance costs $50,000 to $100,000 including self-assessment preparation. Level 2 compliance ranges from $100,000 to $500,000 including control implementation, managed security services, and C3PAO assessment fees. For small businesses, DoD has acknowledged the cost burden and is exploring mechanisms to support compliance. The cost of non-compliance is loss of eligibility for DoD contracts — an existential risk for companies dependent on defense revenue.