DFARS 252.204-7012

Defense acquisition: SBOM delivery, component provenance, prohibited vendor detection.


Short name	DFARS
Region	Americas
Country or scope	United States
Sector	Defense
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DFARS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for DFARS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for DFARS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`DFARS-7012-B2` NIST 800-171 Baseline Inventory	Adequate security requires implementing NIST SP 800-171, whose configuration-management family mandates baseline configurations and inventories of organisational systems including installed software (DFARS 252.204-7012(b)(2); NIST SP 800-171 3.4.1)	Scan
`DFARS-7012-FLAW` Flaw Remediation Visibility	Identifying, reporting and correcting system flaws in a timely manner requires knowing the exact versions of the software in use (DFARS 252.204-7012; NIST SP 800-171 3.14.1)	Scan
`DFARS-7012-C` 72-Hour Incident Scoping	Rapid cyber incident reporting to DoD requires the contractor to determine quickly which covered systems and software components were affected, so components must be unambiguously identifiable (DFARS 252.204-7012(c) rapid reporting)	Scan
`DFARS-7012-M` Subcontractor Flowdown Provenance	The clause must be flowed down to subcontractors, which presumes the contractor knows which suppliers stand behind the software in delivered systems (DFARS 252.204-7012(m); see also Section 889 supplier prohibitions)	Scan
`DFARS-7012-MEDIA` Forensic Integrity of Software	Contractors must preserve and protect images of affected systems for DoD damage assessment, supported by cryptographic hashes that prove component integrity (DFARS 252.204-7012(e) media preservation)	Scan
`DFARS-7012-DOC` Deliverable Software Documentation	Software composition evidence delivered under defense contracts must be attributable and dated to support assessment and audit (DFARS 252.204-7012 assessment/audit context; NIST SP 800-171 documentation requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DFARS-7012-b1`	Provide adequate security on all covered contractor systems
`DFARS-7012-b2`	Report cyber incidents within 72 hours to DoD
`DFARS-7012-b3`	Submit malware identified in cyber incidents to DoD
`DFARS-7012-c`	Rapidly report cyber incidents to contracting officer
`DFARS-7012-d`	Preserve and protect images of compromised systems
`DFARS-7012-f`	Flow DFARS requirements to sub-contractors handling CDI
`DFARS-7012-g`	Implement NIST SP 800-171 and maintain SSP with SPRS score
`DFARS-7012-h`	Cloud services for CDI must use FedRAMP Moderate or equivalent

Policy templates

Written for DFARS:

DFARS 252.204-7012 Adequate Security Policy
SPRS Self-Assessment and Score Maintenance Policy
CDI Media Protection and Sanitization Policy

And 22 from the standard set, adapted to DFARS.