DFARS
The defense supplement to the FAR, the clauses that reach a machine shop through flow-down, and the records a contracting officer expects to find.
DFARS is the Department of Defense supplement to the Federal Acquisition Regulation. For a manufacturer the clause that bites is 252.204-7012, which requires security on systems holding covered defense information, rapid reporting of cyber incidents to DoD, and flow-down of the same clause to subcontractors.
Contract clauses that flow federal requirements down to defense contractors, including safeguarding covered defense information and reporting cyber incidents.
US Department of Defense
Defense contracts and the suppliers they flow down to. DFARS 252.204-7012 and related clauses.
Not a certification. Compliance is a contractual obligation assessed against the clauses in the award.
Contractors and subcontractors holding Department of Defense contracts, and anyone in their supply chain the clauses flow down to.
| Requirement | Module | What It Does |
|---|---|---|
| Covered defense information reaches fewer people | Engineering | Prints, routings, process specifications, and job records sit behind role-based permissions with tenant isolation enforced at the data layer and single sign-on in front of it, so least privilege over controlled technical information is a system setting rather than a habit. For a shop where the same engineer quotes, programs, and ships, least privilege is usually the control that gets waved through on the grounds that everybody needs everything, and it is also the one an assessor probes first. Once you have decided which records are covered defense information, WorkCell is where that decision is enforced: the role that can open a print is the control an assessor can test, rather than a label on a folder nobody checks. |
| Audit records of who did what | Analytics | Transactions carry an audit trail, so a change to a bill of material, a routing, a job, or a posting is attributable to a user and a timestamp. That supports the audit and accountability expectations the clause inherits from NIST SP 800-171, and it gives an incident investigation somewhere concrete to start. The trail exports through the REST API and webhooks, so it lands in whatever monitoring and retention stack already sits inside your boundary. |
| Fewer places the controlled data lives | Production | Jobs, routings, operator entries, inspection results, and costs land on one database instead of a scheduling spreadsheet, a quality folder, and a shared drive of travellers. Shrinking the number of systems that touch covered defense information shrinks the boundary you have to describe and defend. Deployment can be cloud or on premises, and on premises keeps the data inside your own boundary; defining that boundary is still your responsibility. |
| Which orders carry the clause | Sales | Quotes and sales orders hold the customer, the terms, and the documents attached to them, so the contracts that brought a flow-down with them are identifiable rather than remembered. That is the first question in scoping: which work is DoD work. Record the clause against the order once and every quote, job, purchase order and shipment descended from it carries the same thread, so the scope of your boundary is a filtered list rather than an exercise in recall. |
| Flow-down to the suppliers you actually use | Purchasing | The supplier catalog, purchase orders, and receipts give you one list of who you buy from and what went to each of them, which is where a flow-down review starts. Paragraph (m) of 252.204-7012 requires the clause be included in subcontracts without alteration except to identify the parties. Each subcontractor's assessment status is recorded on its supplier record alongside the parts and processes it is approved for, so the flow-down review reads one list instead of chasing certificates through an inbox. |
| One place to see the accounts and roles | Workforce | Employees exist as records with roles attached, so the set of named users and what each role can reach is readable from the system, and offboarding is one change rather than a hunt through five tools. That supports access review as a routine rather than a project. The policy, the training, the authorization decisions, and the assessment itself remain your programme to run and your evidence to produce. |
The clause expects the security requirements of NIST SP 800-171 to be implemented and permits additional measures where reasonably necessary, addressed in a system security plan. Where the DoD CIO has accepted an alternative as equally effective, the contractor need not implement the original requirement. That makes the plan the governing document: it names the systems, the boundary, the requirements met, and the exceptions someone approved. Two things reliably go wrong with it. It gets written once, by a consultant, against an estate that has changed twice since, and it describes systems in the abstract rather than naming the actual ERP instance, the file share, the email tenant, and the laptop the programmer takes home. An assessor compares the plan to the shop in front of them, and the gap between the two is the audit.
DFARS 252.204-7019 and 252.204-7020 put summary level scores for NIST SP 800-171 DoD Assessments in the Supplier Performance Risk System. A Basic Assessment is your own self-evaluation against the system security plan and carries low confidence; Medium and High Assessments are conducted by the Government with document review, verification, and discussion. A prime cannot award you work subject to these requirements unless you have completed at least a Basic Assessment within the last three years.
Cyber incidents are rapidly reported to DoD at dibnet.dod.mil, which the clause defines as within 72 hours of discovery. Images of all known affected information systems and the relevant monitoring data are preserved and protected for at least 90 days from submission of the report, and any malicious software discovered and isolated goes to the DoD Cyber Crime Center. Each of those is a dated artifact a reviewer can ask to see.
Paragraph (m) of 252.204-7012 requires the clause, including paragraph (m) itself, in subcontracts without alteration except to identify the parties. 252.204-7020 carries the same instruction in paragraph (g), and 252.204-7021 requires the prime to insert the substance of its clause where a subcontract involves processing, storing, or transmitting FCI or CUI. The file wanted is the subcontract text, not an assurance that you told them.
Where a contractor uses an external cloud service provider to store, process, or transmit covered defense information, 252.204-7012 requires that provider to meet security requirements equivalent to the FedRAMP Moderate baseline. WorkCell gives you two routes through that paragraph. WorkCell runs a SOC 2 programme and will walk your security reviewer through the controls behind it, and its current status, under NDA. Alternatively, an on-premises deployment keeps covered defense information inside a boundary you assess yourself and removes the external provider question entirely.
Which DFARS clause actually matters to a manufacturing shop?
252.204-7012, safeguarding covered defense information and cyber incident reporting, is the one that changes how you run. It brings NIST SP 800-171 with it. Alongside it sit 252.204-7019 and 252.204-7020 for the SPRS assessment score, and 252.204-7021 for CMMC status.
How quickly do we have to report a cyber incident?
Within 72 hours of discovery, reported to DoD at dibnet.dod.mil. The clause also requires you to preserve and protect images of all known affected systems for at least 90 days from submission, and to submit any isolated malicious software to the DoD Cyber Crime Center.
Does running WorkCell make us DFARS compliant?
No. No system can. The clause binds your company and the systems in your boundary, and compliance is assessed against your plan, your practices, and your evidence. What WorkCell contributes is the part an assessor tests in the system: least privilege over controlled technical information, an attributable audit trail, a smaller boundary, one user list, and an on-premises option that keeps the data inside your own perimeter.
What does 252.204-7012 require of a cloud provider?
An external cloud service provider storing, processing, or transmitting covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. Where that paragraph applies, WorkCell deploys on premises, which keeps covered defense information inside a boundary you control and assess yourself and takes the cloud provider out of the equation.
We are a second-tier supplier with no DoD contract. Does DFARS reach us?
Yes, through flow-down. Paragraph (m) of 252.204-7012 requires primes to include the clause in subcontracts without alteration except to identify the parties, and 252.204-7021 reaches any subcontract involving FCI or CUI. The obligation arrives in your purchase order, not from the Government directly.
Can we buy our way to compliance with the right system?
No, and the vendors who imply otherwise are selling something. A system can keep access tight, hold an audit trail, and reduce the number of places controlled data lives. The boundary, the system security plan, the assessment, and the affirmation are work only your organisation can do.
Keep the records as the work happens.
The plan, the boundary, and the assessment stay yours. WorkCell keeps access, audit trail, and the job record on one system so there is less ground to cover when a prime asks what you did.