Register:Glossary3 recordsSHA3-256 chainedhead sha3:1a577e2f8ac9f60275133f32918e41a953be3ef40468fc66cfe27d116900d9ddIntact
REC 0001DEFINITIONsha3-2569a3fea3a8e16abb0920d9ca0d294ad2266f66053801553a289830b6bd8d7a283prev:54ee5edb19fb

DFARS 252.204-7012 has been in DoD contracts since 2017. It requires implementing NIST SP 800-171, reporting cyber incidents to DoD within 72 hours, and flowing the requirement down to subcontractors handling covered defense information.

It also requires that cloud services storing CUI meet FedRAMP Moderate (or equivalency) — the clause that pulls a contractor's MSP or cloud provider into scope.

CMMC's contractual clause, DFARS 252.204-7021, works alongside 7012 and 7019/7020. The Phase II rollout of certification requirements is suspended while the Department reviews the program; the underlying 7012 safeguarding duty remains active.

REC 0002RELATED RECORDSsha3-2561a577e2f8ac9f60275133f32918e41a953be3ef40468fc66cfe27d116900d9ddprev:9a3fea3a8e16

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Related terms and reading

  1. NIST SP 800-171NIST SP 800-171 is the federal standard of 110 security controls for protecting CUI in non-federal systems: the technical basis of CMMC Level 2.
  2. CUI: Controlled Unclassified InformationCUI is government-created or -owned information that requires safeguarding under law, regulation, or government-wide policy, but is not classified.
  3. SPRS: Supplier Performance Risk SystemSPRS is the DoD system where contractors post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.
  4. ESP vs CSP: When Your MSP Triggers FedRAMP

Know the term. Then see the record behind it.

Request AccessBook a call
Sealed
Last amended
Register colophonRecomputable by a second party
SeqLabelSHA3-256Prev
REC 0000HEAD54ee5edb19fbdb7ca30609e1
REC 0001DEFINITION9a3fea3a8e1654ee5edb19fb
REC 0002RELATED RECORDS1a577e2f8ac99a3fea3a8e16

The record headers on this page are SHA3-256 digests of this page's own copy, chained in sequence from a fixed genesis value. Edit one word of any record's copy above and every digest after it changes. Head of chain: sha3:1a577e2f8ac9. The product does the same thing to your evidence.