DFARS 252.204-7012 - Safeguarding Covered Defense Information

DFARS clause 252.204-7012 (48 CFR 252.204-7012, clause edition MAY 2024). Requires DoD contractors to provide adequate security on covered contractor information systems by implementing NIST SP 800-171, to rapidly report cyber incidents (within 72 hours of discovery) to DoD via dibnet.dod.mil using a DoD-approved medium assurance certificate, to submit isolated malicious software to the DoD Cyber Crime Center (DC3), to preserve affected media and monitoring data for at least 90 days, to support forensic analysis and damage assessment, and to flow the clause down to in-scope subcontracts.