DFARS readiness, step by step
DFARS Readiness gives small and mid-size contractors checklists and plain-English guides for DFARS cybersecurity clauses.
Latest guides
1
What Is the 72-Hour Incident Reporting Rule?
DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through dibnet, preserve forensic evidence for 90 days, and flow the rule down to subcontractors.
2
What Is CUI and How Do I Know If I Have It?
Controlled Unclassified Information in plain words, plus how a small contractor tells whether it handles CUI.
3
What Does DFARS Flow-Down Mean for My Subcontractors?
A plain explanation of DFARS flow-down: which cybersecurity clauses reach subcontractors, what primes must do, and what subcontractors must deliver.
4
What Is SPRS and How Do I Post My Score There?
How to post your NIST 800-171 self-assessment score in the Supplier Performance Risk System.
5
How Do I Calculate My 800-171 Self-Assessment Score?
The DoD assessment methodology arithmetic: how the 110-point start, the weighted deductions, and the SPRS score actually work.
6
What Are DFARS 252.204-7019 and 7020?
DFARS 252.204-7019 is the pre-award assessment notice. 252.204-7020 is the contract clause. Plain-English duties, scoring, and your this-week checklist.
7
A Simple DFARS Readiness Checklist for Small Contractors
A practical checklist to get a small contractor ready for DFARS cyber requirements.
8
What Is DFARS 252.204-7012 in Plain English?
Plain answers about the Defense Department cyber clause and its 72 hour reporting rule.