DFARS readiness, step by step
DFARS Readiness gives small and mid-size contractors checklists and plain-English guides for DFARS cybersecurity clauses.
Latest guides
1
Does the Coming CIRCIA Rule Replace Your DFARS Incident Reporting?
CISA sent the final CIRCIA rule to White House review on October 1, 2026. It adds a second reporting duty to CISA. It does not replace DFARS 252.204-7012 reporting to DoD.
2
What Is the 72-Hour Incident Reporting Rule?
DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through dibnet, preserve forensic evidence for 90 days, and flow the rule down to subcontractors.
3
What Is CUI and How Do I Know If I Have It?
Controlled Unclassified Information in plain words, plus how a small contractor tells whether it handles CUI.
4
What Does DFARS Flow-Down Mean for My Subcontractors?
A plain explanation of DFARS flow-down: which cybersecurity clauses reach subcontractors, what primes must do, and what subcontractors must deliver.
5
What Is SPRS and How Do I Post My Score There?
How to post your NIST 800-171 self-assessment score in the Supplier Performance Risk System.
6
How Do I Calculate My 800-171 Self-Assessment Score?
The DoD assessment methodology arithmetic: how the 110-point start, the weighted deductions, and the SPRS score actually work.
7
What Are DFARS 252.204-7019 and 7020?
DFARS 252.204-7019 is the pre-award assessment notice. 252.204-7020 is the contract clause. Plain-English duties, scoring, and your this-week checklist.
8
A Simple DFARS Readiness Checklist for Small Contractors
A practical checklist to get a small contractor ready for DFARS cyber requirements.
9
What Is DFARS 252.204-7012 in Plain English?
Plain answers about the Defense Department cyber clause and its 72 hour reporting rule.