Defense industrial base cybersecurity is the set of DoD rules and programs that protect contractor networks holding defense information. The core pieces are DFARS clause 252.204-7012, which requires security controls and 72-hour incident reporting, CMMC verification, and voluntary information sharing through DC3.
What the defense industrial base is
DoD’s rule on defense industrial base cybersecurity activities (32 CFR part 236) defines the defense industrial base, or DIB, as the DoD, government and private sector worldwide industrial complex with capabilities to perform research and development, design, produce and maintain military weapon systems, subsystems, components or parts. In practice that includes large primes and small suppliers alike, because defense information moves down subcontract chains.
The same rule defines covered defense information as unclassified controlled technical information or other information described in the CUI Registry that requires safeguarding. A “covered contractor information system” is an unclassified system owned or operated by or for a contractor that processes, stores or transmits that information. These two terms decide whether the rules below apply to a company.
DFARS 252.204-7012: the baseline clause
The main contract clause is DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. It says the contractor shall provide adequate security on all covered contractor information systems and, for systems not operated on behalf of the government, subjects them to NIST SP 800-171. The requirements themselves are explained in NIST SP 800-171 explained.
The clause adds conditions beyond the NIST list. A contractor that uses an external cloud service provider to store, process or transmit covered defense information must require security equivalent to the FedRAMP Moderate baseline, and the provider must meet the clause’s reporting, malware, media preservation, forensic access and damage assessment paragraphs.
Reporting a cyber incident
When a contractor discovers a cyber incident affecting a covered system or the covered defense information in it, the clause requires a review for evidence of compromise and a rapid report. “Rapidly report” is defined as within 72 hours of discovery of any cyber incident. Reports go through DoD’s DIBNet portal, and the clause requires a DoD-approved medium assurance certificate to submit one.
| Obligation | What the clause says |
|---|---|
| Report | Rapidly report, meaning within 72 hours of discovery |
| Access to report | Hold a DoD-approved medium assurance certificate |
| Malware | Submit isolated malicious software to the DoD Cyber Crime Center (DC3), not to the Contracting Officer |
| Evidence | Preserve images of affected systems and relevant monitoring and packet capture data for at least 90 days from the report |
| Forensics | Give DoD access to additional information or equipment on request |
Source: DFARS 252.204-7012, paragraphs (a) and (c) to (f).
DoD says it protects contractor attributional or proprietary information it receives under the clause from unauthorized use or release, and asks contractors to mark such information to the maximum extent practicable.
Subcontractors and the flow-down
The clause includes a flow-down. A prime must include it, without alteration except to identify the parties, in subcontracts for operationally critical support or where subcontract performance involves covered defense information, including subcontracts for commercial products or services. Subcontractors must also provide the DoD-assigned incident report number to the prime, or next higher-tier subcontractor, as soon as practicable after reporting an incident, and notify the prime when requesting a variance from a NIST SP 800-171 requirement.
CMMC adds verification
The 7012 clause sets the obligation; CMMC adds a way to verify it. The CMMC program rule describes the DoD clause as requiring adequate security by implementing the 110 security requirements of NIST SP 800-171, and CMMC adds assessments and a recorded status on top of that. Levels, assessment types and rollout phases are in CMMC explained.
Voluntary sharing through DC3 and DCISE
Alongside the mandatory rules, 32 CFR part 236 sets up a voluntary DIB Cybersecurity Program. Under it, the government and each participating contractor sign a Framework Agreement to share cybersecurity information in a timely and secure manner on a recurring basis. The rule names the DC3-managed DoD-DIB Collaborative Information Sharing Environment (DCISE) as the operational focal point for cyber threat information sharing and incident reporting under the program, and says participants are encouraged to share cyber threat indicators they believe are valuable in alerting the government and other participants.
Assessment and scoring resources
DoD’s safeguarding covered defense information page collects the guidance contractors use: the NIST SP 800-171 DoD Assessment Methodology, the Supplier Performance Risk System (SPRS) memoranda and the November 6, 2018 guidance on reviewing system security plans and the NIST SP 800-171 requirements not yet implemented. That guidance is meant to enable consistent review of system security plans and plans of action when a solicitation or contract requires them to be provided to the government. The methodology produces the score contractors post in SPRS, a number that starts at 110 and goes down for each requirement not implemented.
The wider push for cyber resilience, including zero trust, is covered in the guide to zero trust for defense networks.
Where to follow DIB cybersecurity in person
Air Force IT and cyber staff and private sector technology leaders gather each year at the Department of the Air Force’s IT and cyberpower event in Montgomery, Alabama. The AFITC conference guide explains what the event is, who attends and where official details are published. For how these contractor rules fit with the agencies and frameworks around them, see the guide to defense cybersecurity.
Frequently asked questions
Who has to report a cyber incident under DFARS 7012?
A contractor whose covered contractor information system or covered defense information is affected, or whose operationally critical support is affected. The clause flows down to subcontractors with covered defense information.
How quickly must an incident be reported?
Within 72 hours of discovery, per the clause and the definition in 32 CFR part 236.
Where does malware found during an incident go?
To DC3, following instructions from DC3 or the Contracting Officer. The clause says not to send it to the Contracting Officer.
Is DCISE participation required?
No. The DIB Cybersecurity Program in 32 CFR part 236 is voluntary, while incident reporting under the contract clause is mandatory.
Does this article make a company compliant?
No. It summarizes public rules and is not legal advice. Read the clauses in a specific solicitation or contract.
Photo credits: Cherie Cullen, U.S. Department of Defense (Public domain (U.S. federal government work)); Brett Sayles (Pexels License).
