DFARS readiness, step by step
DFARS Readiness gives small and mid-size contractors checklists and plain-English guides for DFARS cybersecurity clauses.
Latest guides
1
Atlassian Flaw and the 72-Hour Rule When Credentials May Be Read
CVE-2026-21589 lets unauthenticated attackers read server files, including credentials in some configurations. Under DFARS 252.204-7012, a suspected credential compromise starts a 72-hour cyber incident report clock and a 90-day log preservation duty.
2
A Root-Level Appliance Flaw Can Start the DFARS 7012 Clock
Cisco fixed a 9.8 unauthenticated root flaw in clustered Expressway on October 21, 2026. If that flaw becomes a cyber incident, DFARS 252.204-7012 sets a 72 hour report duty and a 90 day evidence duty.
3
Your January 2027 Deliveries May Carry the Wrong DFARS Clause
On January 1, 2027, DFARS 252.225-7052 expands its covered materials rule. A newer clause, 252.225-7961, can limit the damage, but only if you amend your contracts before then.
4
Rank Math Backdoor: When a Plugin Backdoor Starts Your 72-Hour Clock
[CVE-2026-111862](https://www.cve.org/CVERecord?id=CVE-2026-111862) is a 9.8 Critical supply chain backdoor in Rank Math SEO PRO 3.0.123. Credential theft on a contractor site can trigger the DFARS 252.204-7012 72-hour cyber incident reporting clock.
5
What does 'adequate security' actually mean in DFARS 252.204-7012?
DFARS 252.204-7012 defines adequate security as protection matched to risk. Here is what that means in practice for a small contractor.
6
Active Exploitation of a Network Management Plane Starts the 72 Hour Clock
DFARS 252.204-7012 gives you 72 hours to report a cyber incident. An exploited orchestrator that touches covered networks fits that clock.
7
A CA Compromise and Your 72 Hour Reporting Clock
The eMudhra CA compromise did not touch most contractors directly. It still tests your DFARS 252.204-7012 incident response. A third party trust failure that can forge your certificates is an incident to assess.
8
GitLab RCE and DFARS Incident Reporting Duties
CVE-2026-110264 is a 10.0 Critical GitLab flaw that needs no login. If a code host is hit, Defense Federal Acquisition Regulation Supplement reporting duties can follow fast.
9
When the Edge Appliance Is Exploited, the DFARS Reporting Clock May Start
Four exploited flaws hit firewalls, a mail gateway, and backup servers. Defense contractors should decide fast whether an exploited appliance touches covered defense information and starts the 72 hour report.
10
Stolen Workstation Credentials Can Start a DFARS Incident Clock
The OVHcloud CLI swap stole workstation secrets. Under Defense Federal Acquisition Regulation Supplement 252.204-7012, stolen contractor credentials can become a reportable cyber incident.
11
If PwnEscape Hit Your Network, DFARS 252.204-7012 Starts a 72 Hour Clock
CVE-2026-99999 is a 9.3 Critical VM escape. If it is exploited on a contractor system holding covered defense information, the DFARS cyber incident clock starts.
12
A Backdoored WordPress Site Can Trigger DFARS 252.204-7012
Stolen UpdraftCentral keys pushed backdoors to WordPress sites. If a contractor site held covered defense information, the 72 hour DIBNet clock applies.
13
What Is NIST 800-172 and Does It Apply to Me?
NIST 800-172 adds tougher security requirements on top of 800-171 for contracts tied to critical programs and high value assets.
14
An Exploited Gateway Flaw Starts the DFARS 7012 Clock
If an exploited Ivanti gateway flaw leads to a cyber incident, DFARS 252.204-7012 sets a 72 hour report duty and a 90 day evidence duty. A Windows flaw was listed the same day.
15
You Cannot Patch What You Forgot: PHP2Shell, LiteLLM, and Governance
Two failures on one day show why governance means a true map of your runtimes, packages, secrets, and data.
16
If Plex2Shell Hit Your Network, DFARS 252.204-7012 Starts a 72 Hour Clock
A compromised server can trigger the 72 hour DFARS cyber incident report. Here is what the clock asks for and what to gather first.
17
Where Does a Small Contractor Start With DFARS This Week?
A five day DFARS action plan for small contractors: know your CUI, score yourself, write the SSP, post to SPRS.
18
DHS Just Ordered DeepSeek Out of Federal Civilian IT. Does It Reach Your Company?
On October 20, 2026, DHS published an order removing DeepSeek products and tools built on them from federal civilian agency systems. Here is what it means for contractors.
19
How Do DFARS and CMMC Fit Together?
DFARS clauses require NIST 800-171 today. CMMC is how DoD verifies it tomorrow. How 7012, 7019, 7020, and 7021 divide the work.
20
Your Vendor Was Breached, Not You. Do You Still Owe DoD a Report?
On October 15, 2026, the U.S. Courts disclosed a cyber incident at BAE Systems that halted the federal Bankruptcy Noticing Center. Under DFARS 252.204-7012, a breach on a vendor's system is still your incident to report. Here is why, and the five steps to take this week.
21
What Happens If We Are Not DFARS Compliant?
The real consequences of missing DFARS cyber requirements: lost awards, contract remedies, False Claims Act exposure, and what to fix first.
22
How Do I Write a System Security Plan for DFARS?
A step-by-step guide to writing an SSP that satisfies DFARS and NIST 800-171.
23
Does the Coming CIRCIA Rule Replace Your DFARS Incident Reporting?
CISA sent the final CIRCIA rule to White House review on October 1, 2026. It adds a second reporting duty to CISA. It does not replace DFARS 252.204-7012 reporting to DoD.
24
What Is the 72-Hour Incident Reporting Rule?
DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through dibnet, preserve forensic evidence for 90 days, and flow the rule down to subcontractors.
25
What Is CUI and How Do I Know If I Have It?
Controlled Unclassified Information in plain words, plus how a small contractor tells whether it handles CUI.
26
What Does DFARS Flow-Down Mean for My Subcontractors?
A plain explanation of DFARS flow-down: which cybersecurity clauses reach subcontractors, what primes must do, and what subcontractors must deliver.
27
What Is SPRS and How Do I Post My Score There?
How to post your NIST 800-171 self-assessment score in the Supplier Performance Risk System.
28
How Do I Calculate My 800-171 Self-Assessment Score?
The DoD assessment methodology arithmetic: how the 110-point start, the weighted deductions, and the SPRS score actually work.
29
What Are DFARS 252.204-7019 and 7020?
DFARS 252.204-7019 is the pre-award assessment notice. 252.204-7020 is the contract clause. Plain-English duties, scoring, and your this-week checklist.
30
A Simple DFARS Readiness Checklist for Small Contractors
A practical checklist to get a small contractor ready for DFARS cyber requirements.
31
What Is DFARS 252.204-7012 in Plain English?
Plain answers about the Defense Department cyber clause and its 72 hour reporting rule.