Compliance with Safeguarding Covered Defense Information Controls

Who must comply

Any offeror on a DoD solicitation that will involve Covered Defense Information.

What it requires

1. 01Represent that the offeror will implement the NIST SP 800-171 security requirements no later than the date of contract award.
2. 02Disclose any controls the offeror intends not to implement, with explanation, so the DoD CIO may adjudicate.
3. 03Treat the representation as a material element of the offer.

Related clauses

• DFARS 252.204-7012
  Safeguarding Covered Defense Information and Cyber Incident Reporting

  DFARS 252.204-7012 requires DoD contractors that handle Covered Defense Information (CDI) to implement the security requirements of NIST SP 800-171, report cyber incidents to DoD within 72 hours via the DIBNet portal, and use FedRAMP Moderate (or equivalent) cloud services for CDI. It has been the contractual basis for NIST 800-171 across the defense industrial base since 2017.

Related terms

• Controlled Unclassified Information
• NIST SP 800-171