DFARS readiness, step by step
DFARS Readiness gives small and mid-size contractors checklists and plain-English guides for DFARS cybersecurity clauses.
Latest guides
1
DHS Just Ordered DeepSeek Out of Federal Civilian IT. Does It Reach Your Company?
On October 20, 2026, DHS published an order removing DeepSeek products and tools built on them from federal civilian agency systems. Here is what it means for contractors.
2
How Do DFARS and CMMC Fit Together?
DFARS clauses require NIST 800-171 today. CMMC is how DoD verifies it tomorrow. How 7012, 7019, 7020, and 7021 divide the work.
3
Your Vendor Was Breached, Not You. Do You Still Owe DoD a Report?
On October 15, 2026, the U.S. Courts disclosed a cyber incident at BAE Systems that halted the federal Bankruptcy Noticing Center. Under DFARS 252.204-7012, a breach on a vendor's system is still your incident to report. Here is why, and the five steps to take this week.
4
What Happens If We Are Not DFARS Compliant?
The real consequences of missing DFARS cyber requirements: lost awards, contract remedies, False Claims Act exposure, and what to fix first.
5
How Do I Write a System Security Plan for DFARS?
A step-by-step guide to writing an SSP that satisfies DFARS and NIST 800-171.
6
Does the Coming CIRCIA Rule Replace Your DFARS Incident Reporting?
CISA sent the final CIRCIA rule to White House review on October 1, 2026. It adds a second reporting duty to CISA. It does not replace DFARS 252.204-7012 reporting to DoD.
7
What Is the 72-Hour Incident Reporting Rule?
DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through dibnet, preserve forensic evidence for 90 days, and flow the rule down to subcontractors.
8
What Is CUI and How Do I Know If I Have It?
Controlled Unclassified Information in plain words, plus how a small contractor tells whether it handles CUI.
9
What Does DFARS Flow-Down Mean for My Subcontractors?
A plain explanation of DFARS flow-down: which cybersecurity clauses reach subcontractors, what primes must do, and what subcontractors must deliver.
10
What Is SPRS and How Do I Post My Score There?
How to post your NIST 800-171 self-assessment score in the Supplier Performance Risk System.
11
How Do I Calculate My 800-171 Self-Assessment Score?
The DoD assessment methodology arithmetic: how the 110-point start, the weighted deductions, and the SPRS score actually work.
12
What Are DFARS 252.204-7019 and 7020?
DFARS 252.204-7019 is the pre-award assessment notice. 252.204-7020 is the contract clause. Plain-English duties, scoring, and your this-week checklist.
13
A Simple DFARS Readiness Checklist for Small Contractors
A practical checklist to get a small contractor ready for DFARS cyber requirements.
14
What Is DFARS 252.204-7012 in Plain English?
Plain answers about the Defense Department cyber clause and its 72 hour reporting rule.