DFARS readiness, step by step
DFARS Readiness gives small and mid-size contractors checklists and plain-English guides for DFARS cybersecurity clauses.
Latest guides
1
How Do DFARS and CMMC Fit Together?
DFARS clauses require NIST 800-171 today. CMMC is how DoD verifies it tomorrow. How 7012, 7019, 7020, and 7021 divide the work.
2
Your Vendor Was Breached, Not You. Do You Still Owe DoD a Report?
On October 15, 2026, the U.S. Courts disclosed a cyber incident at BAE Systems that halted the federal Bankruptcy Noticing Center. Under DFARS 252.204-7012, a breach on a vendor's system is still your incident to report. Here is why, and the five steps to take this week.
3
What Happens If We Are Not DFARS Compliant?
The real consequences of missing DFARS cyber requirements: lost awards, contract remedies, False Claims Act exposure, and what to fix first.
4
How Do I Write a System Security Plan for DFARS?
A step-by-step guide to writing an SSP that satisfies DFARS and NIST 800-171.
5
Does the Coming CIRCIA Rule Replace Your DFARS Incident Reporting?
CISA sent the final CIRCIA rule to White House review on October 1, 2026. It adds a second reporting duty to CISA. It does not replace DFARS 252.204-7012 reporting to DoD.
6
What Is the 72-Hour Incident Reporting Rule?
DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through dibnet, preserve forensic evidence for 90 days, and flow the rule down to subcontractors.
7
What Is CUI and How Do I Know If I Have It?
Controlled Unclassified Information in plain words, plus how a small contractor tells whether it handles CUI.
8
What Does DFARS Flow-Down Mean for My Subcontractors?
A plain explanation of DFARS flow-down: which cybersecurity clauses reach subcontractors, what primes must do, and what subcontractors must deliver.
9
What Is SPRS and How Do I Post My Score There?
How to post your NIST 800-171 self-assessment score in the Supplier Performance Risk System.
10
How Do I Calculate My 800-171 Self-Assessment Score?
The DoD assessment methodology arithmetic: how the 110-point start, the weighted deductions, and the SPRS score actually work.
11
What Are DFARS 252.204-7019 and 7020?
DFARS 252.204-7019 is the pre-award assessment notice. 252.204-7020 is the contract clause. Plain-English duties, scoring, and your this-week checklist.
12
A Simple DFARS Readiness Checklist for Small Contractors
A practical checklist to get a small contractor ready for DFARS cyber requirements.
13
What Is DFARS 252.204-7012 in Plain English?
Plain answers about the Defense Department cyber clause and its 72 hour reporting rule.