DFARS Readiness Checklists and guides for DFARS readiness.

Guides / October 23, 2026

What does 'adequate security' actually mean in DFARS 252.204-7012?

You found "adequate security" in your contract and wondered what it actually requires. The phrase comes from DFARS 252.204-7012. DFARS stands for the Defense Federal Acquisition Regulation Supplement. It is the Defense Department's set of contract rules for safeguarding covered defense information.

The one-sentence definition

The clause defines the term in paragraph (a):

"Adequate security" means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information. (DFARS 252.204-7012)

That is the whole legal definition. Everything else in this article is the practical meaning of it.

Diagram: DFARS 252.204-7012 adequate security equals NIST SP 800-171 as the minimum, plus extra measures wherever risk demands

What "commensurate" means

Commensurate is a lawyer's word for "matched to the risk." Two factors decide the match. First, the consequences: how bad is the harm if the information is lost or misused? Second, the probability: how likely is that loss? Protection should fit both.

A spreadsheet of lunch orders does not need the same armor as export-controlled design drawings. A locked file cabinet may be enough for one and nowhere near enough for the other.

So adequate security is not one fixed bar. It is a floor plus judgment. The clause sets the floor. Your own risk fills in the rest.

The floor: NIST SP 800-171

Paragraph (b) of the clause makes the minimum concrete. (DFARS 252.204-7012) You must provide adequate security on all covered contractor information systems. (DFARS 252.204-7012) A covered contractor information system is an unclassified system you own or operate. It processes, stores, or transmits covered defense information. (DFARS 252.204-7012)

For these systems, you must meet the security requirements in NIST SP 800-171. (DFARS 252.204-7012) NIST stands for the National Institute of Standards and Technology. SP stands for Special Publication. The publication is titled "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." CUI stands for Controlled Unclassified Information. NIST published Revision 2 in February 2020. (NIST CSRC)

The edition that counts is the one in effect when the solicitation was issued. The contracting officer can authorize a different edition. (DFARS 252.204-7012)

NIST SP 800-171 organizes its requirements into control families. Each family covers one area of protection:

  • Access control: only named people can open the folders that hold the data. Evidence: the permission list.
  • Audit and accountability: you log who opened or changed the files. Evidence: the log entries.
  • Identification and authentication: users prove who they are, with multi-factor authentication where it matters. Evidence: the settings showing it is on.
  • Incident response: you have a written plan with a name and a phone number. Evidence: the plan itself.

Do not cherry-pick. The clause expects every requirement to be met or formally addressed. If a requirement does not apply to you, say so in writing. You can request a ruling from the DoD Chief Information Officer through your contracting officer. (DFARS 252.204-7012) DoD stands for Department of Defense.

When the floor is not enough

Paragraph (b)(3) adds the second half of the definition. (DFARS 252.204-7012) You must apply other security measures when you reasonably determine they may be required to provide adequate security. (DFARS 252.204-7012)

The clause names three triggers. A dynamic environment, such as systems that change often. Special circumstances, such as medical devices. And any individual, isolated, or temporary deficiency tied to an assessed risk or vulnerability. (DFARS 252.204-7012) You may record these extra measures in a system security plan. (DFARS 252.204-7012) SSP stands for System Security Plan.

In plain terms: if your risk goes above the baseline, your protection must rise with it. A laptop that travels to customer sites needs more than the same machine locked in a server room. A system exposed to the internet needs more than one on a closed network.

The cloud rule

If you use an external cloud provider for covered defense information, one rule applies. The provider must meet security requirements equivalent to the FedRAMP Moderate baseline. (DFARS 252.204-7012) FedRAMP stands for the Federal Risk and Authorization Management Program. The provider must also follow the clause's rules on incident reporting, malicious software, media preservation, and forensic access. (DFARS 252.204-7012)

What a small contractor should do now

  1. Confirm the clause is in your contract. If DFARS 252.204-7012 is in your award, the work below applies to you.
  2. Identify your covered defense information. Check the contract markings and the CUI Registry. (CUI Registry) List the categories you hold.
  3. Draw the boundary. List every system that processes, stores, or transmits the information. These are your covered contractor information systems.
  4. Work through NIST SP 800-171. Address every requirement, one family at a time. Do not skip the ones that feel hard.
  5. Document everything in a system security plan. Name each system and describe how each requirement is met.
  6. Ask for relief where needed. If a requirement does not apply, say so in writing. If you have an equally effective alternative, describe it in writing too. Send both to the contracting officer for DoD Chief Information Officer adjudication. (DFARS 252.204-7012)
  7. Add extra measures where your risk is higher. Write down why you added each one.

Adequate security is not a one-time project. Review the plan when your systems or your risks change. Note the review date.

Sources

Next step

Adequate security starts with knowing where your gaps are. PolicyCortex evaluates live Azure and AWS configuration against NIST 800-53 and NIST 800-171. It builds SSP, SAR, and POA&M output from the collected evidence. SSP stands for System Security Plan. SAR stands for Security Assessment Report. POA&M stands for Plan of Action and Milestones.