DFARS 7012 → 7021 as one continuous loop.
DFARS 252.204-7012 safeguards, 7019 SPRS assessment information, and 7020 government assessment rights remain active while the Phase II CMMC rollout is suspended. PolicyCortex unifies the evidence chain so your NIST SP 800-171 Rev. 2 baseline is current, remediated, and defensible.
- CAP-017012 safeguards liveAll 110 NIST 800-171 controls continuously validated.
- CAP-027019 SPRS scoreScore calculated continuously; submission package auto-prep.
- CAP-037020 NIST assessmentBasic / Medium / High assessment-ready evidence.
- CAP-047021 CMMCL2 + L3 C3PAO-ready OSCAL packages.
- CAP-05Cyber incident reporting72h reporting templates auto-drafted on detection.
- CAP-06DoD MC + SPRS submissionSubmission packages prepared, ready to upload.
- 01BaselineAll four clauses mapped to one control evidence set.
- 02ScoreSPRS score calculated. Submission package staged.
- 03MaintainContinuous evidence. 72h incident reporting auto-drafted.
- DOE National LabActive consultant
- MITRECybersecurity engineering
- USAAFinancial-grade ops
- FrontierProduction cloud architecture
Founder runs every engagement personally. 4 U.S. patent applications filed.
Difference between 7012 and 7021?
7012 requires contractors to safeguard covered defense information using NIST SP 800-171 and remains active. 7021 is the CMMC contract clause. The Department suspended the Phase II transition and future CMMC implementation milestones on July 13, 2026, while keeping Phase I self-assessments in place.
What's a good SPRS score?
Scoring is 110 max (perfect compliance), negative below. Most defense contractors today sit at 70-90. PolicyCortex output reliably produces +110 once remediation is complete.
72-hour incident reporting?
DFARS 7012 requires reporting cyber incidents involving CUI within 72 hours. PolicyCortex auto-drafts the DoD MC submission template when an incident pattern is detected.
Subcontractor flow-down?
All DFARS 252.204-7xxx clauses flow down. PolicyCortex output supports multi-tier supply chain — primes and subs use the same evidence model.
One substrate. All four clauses.
$15,000 flat for the 30-day pilot. CMMC L2 baseline produces every DFARS artifact your contracting officer expects.