What Happens If We Are Not DFARS Compliant?

Your company signs a defense contract. The cyber clauses inside it can end your federal business. DFARS stands for Defense Federal Acquisition Regulation Supplement. It is the Department of Defense add-on to government buying rules. Noncompliance brings real consequences, and they hit in a clear order. Here is what each one looks like and how to avoid it.

1. You can lose the award before work starts

NIST stands for the National Institute of Standards and Technology. SP 800-171 is its guide for protecting unclassified information on company systems. DFARS 252.204-7019 sets a gate at award time. If you must implement those rules, you need a current assessment to be considered for award. Current means not more than three years old. You post the summary level score in SPRS. SPRS stands for the Supplier Performance Risk System. It is the Defense Department's database of contractor risk scores. No current score in SPRS means no award. (DFARS 252.204-7019)

DFARS 252.204-7020 backs up that gate. The Defense Department can run its own Medium or High assessment through DCMA. DCMA stands for the Defense Contract Management Agency. You must open your facilities, systems, and people to their assessors. You cannot give a subcontract to a company without a current assessment on file. (DFARS 252.204-7020)

2. Your contract can be cut short

DoD guidance treats missing cyber plans as a material breach. Material breach means breaking a central promise of the contract. The remedies are plain. The government can withhold progress payments. It can skip your remaining contract options. It can terminate the contract in part or in whole. A DoD document dated 2022 states the rule plainly. Failure to have or make progress on your NIST SP 800-171 plan may count as a material breach. (Why Defense Contractors Need to Comply with DFARS Now)

3. False claims liability is real

There is a law called the False Claims Act. FCA is the short form. It punishes companies that knowingly take government money under false statements. The Justice Department runs a Civil Cyber-Fraud Initiative. It started in 2021. It targets contractors that misrepresent their cyber security or ignore cyber obligations in federal contracts. (Heightened Cyber False Claims Risk)

This is not theory. On June 18, 2026, a contractor called LOGZONE agreed to pay $507,144. The payment resolved False Claims Act claims about cyber security gaps on two Navy contracts. The Justice Department said the company self-reported a perfect score of 110. Its own NIST SP 800-171 controls were missing. A later Defense Contract Management Agency assessment scored the company at negative 170. The scoring scale runs from negative 203 to 110. The settlement resolved allegations only; it made no finding of liability. (DOJ Settles False Claims Act Case with LOGZONE)

The lesson is direct. A score you post is a statement. If the real controls do not match it, the False Claims Act can apply even with no breach.

4. A late incident report is its own violation

DFARS 252.204-7012 defines rapidly report as within 72 hours of discovery. You file through the Defense Department's reporting portal. You must preserve affected system images and data for at least 90 days. Missing the 72 hour deadline is a separate breach from the incident itself. A perfect network that hides a breach is still noncompliant. (DFARS 252.204-7012)

5. Your subcontractors' gaps become your problem

The clause flows down. You must put it unchanged in every subcontract that involves covered defense information. Covered defense information means unclassified defense data that law or policy says to protect. CUI stands for Controlled Unclassified Information. It is the broad family that this data belongs to. If your subcontractor ignores the rules, your prime contract is the one at risk. Primes often demand a subcontractor's SSP and SPRS score before award. SSP stands for System Security Plan. It describes the controls you have in place. POA&M stands for Plan of Action and Milestones. It lists gaps and fix dates. (DFARS 252.204-7012)

6. CMMC will block you at the door

DFARS 252.204-7021 brings CMMC into the contract. CMMC stands for Cybersecurity Maturity Model Certification. It is the Defense Department's program for checking contractor cyber security. The program rule sits at 32 CFR Part 170. Your contract will name the CMMC level you need. Without the matching certification, the contracting officer cannot award you the work. (32 CFR Part 170, CMMC Program)

What to fix first

This week, work this list in order. Check your contract for the clause. List every system that stores, processes, or transmits covered defense information. Self-assess each system against NIST SP 800-171. Write your SSP and keep your POA&M honest. Post your SPRS score before you bid. Put the clause in your subcontracts. Test your 72 hour reporting process before a real incident. Keep evidence for every control you claim.

PolicyCortex collects evidence from live Azure configuration against NIST 800-171 and 800-53. It builds your SSP, your POA&M, and your SAR from that evidence. SAR stands for Security Assessment Report.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7019 and 252.204-7020, NIST SP 800-171 DoD Assessment Requirements
• NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• 32 CFR Part 170, CMMC Program
• DoD guidance on material breach remedies for NIST SP 800-171 noncompliance
• SPRS scoring methodology
• DOJ Civil Cyber-Fraud Initiative overview
• DOJ LOGZONE False Claims Act settlement

Next step

You now know the six consequences. Pick the first fix on the list and do it this week.

See how PolicyCortex collects compliance evidence automatically