Does DFARS 252.204-7012 Apply If My Contract Only Has Federal Contract Information?

Your contract may list a long clause and hold no defense data. That mismatch confuses small contractors every week. The answer turns on one term in the clause itself.

DFARS means Defense Federal Acquisition Regulation Supplement. FCI means Federal Contract Information. CDI means Covered Defense Information. CUI means Controlled Unclassified Information. FCI is information the government gives you to perform a contract, but it is not meant for public release. CDI is a narrower set. It covers controlled technical information and other defense information that needs safeguarding.

What the clause actually requires

DFARS 252.204-7012 requires safeguarding of CDI. It points to NIST SP 800-171 for the safeguards. NIST SP 800-171 means the NIST guide for protecting CUI on nonfederal systems. The clause also requires rapid cyber incident reporting to the Department of Defense. That reporting duty attaches to CDI incidents.

If your contract holds only FCI and no CDI, the 800-171 duty has nothing to attach to. FCI alone does not turn into CDI. The basic safeguarding rules for FCI come from a different clause, FAR 52.204-21. FAR means Federal Acquisition Regulation. That clause lists 15 basic safeguards. It does not require a full 800-171 program.

Why the clause may still appear in your contract

Contracting officers often add the clause by standard practice. Its presence alone does not prove you hold CDI. Read the contract as a whole. Check the statement of work for defense data. Check the data delivery list for marked items. Check whether any task asks you to receive, store, or create defense technical data. If none of these appear, you likely hold only FCI.

Do not guess in silence. Write to the contracting officer and ask. Ask whether the government expects you to receive CDI under this contract. Ask in writing and keep the answer with the contract file. A written answer beats a verbal guess when an auditor asks later.

What changes if CDI arrives later

A contract can start with FCI only and gain CDI later. A new task order can add defense data. A subcontractor can pass down a drawing marked as controlled. An email can carry an unmarked file that is in fact CDI. Treat any new defense data as a trigger. Stop and check the clause duties before you store it. Start the 800-171 safeguards for that data. Start the incident reporting plan for that data. Tell the prime or the contracting officer that CDI has arrived.

What to do this week

First, read the clauses in your contract and highlight the data terms. Second, list the data you actually receive under each task. Third, match each data type to FCI or CDI. Fourth, write to the contracting officer about any clause that does not match your data. Fifth, file the answer with the contract. That file is your proof if the question comes up again.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information.
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
• NIST SP 800-171 Revision 2.
• Original diagram by PolicyCortex.

Next step

Want evidence tied to each safeguard from live systems? See how PolicyCortex collects it.