DFARS 252.204‑7012 Explained (2026 Update): What Primes and Subs Must Do Before Accepting CUI
Bottom line: before a contractor accepts Controlled Unclassified Information (CUI) from DoD or a prime, DFARS 252.204‑7012 imposes concrete security, reporting, and cloud-handling duties—on both primes and subs—that must be in place first, not “as you go.” Non‑compliance risks contractual violations, bid ineligibility as CMMC phases in, and even False Claims Act exposure.
What DFARS 252.204‑7012 Actually Requires
DFARS 252.204‑7012 requires contractors to:
(1) Provide adequate security for Covered Defense Information (CDI/CUI);
(2) Implement NIST SP 800‑171;
(3) Report cyber incidents within 72 hours;
(4) Submit malware to DC3 if discovered;
(5) Preserve images/logs/data for forensic review;
(6) Flow down the entire clause to applicable subcontractors; and
(7) Use FedRAMP Moderate‑equivalent cloud services when CUI touches the cloud.
CDI/CUI defined. DFARS cross‑references the CUI Registry and includes Controlled Technical Information (CTI) and other protected categories provided by DoD or generated in performance and not intended for public release.
