Where Does a Small Contractor Start With DFARS This Week?

DFARS cybersecurity rules feel huge, so most small contractors never start. You do not need a huge program on day one. You need five days of focused work that puts you on the map. Here is the week.

Day one: find out if you have CUI

DFARS 252.204-7012 applies when your contract involves covered defense information or CUI. CUI is Controlled Unclassified Information, sensitive government data that is not classified. (DFARS 252.204-7012)

Read your contract. Look for the clause numbers 252.204-7012, 252.204-7019, and 252.204-7020. DFARS 252.204-7019 requires you to have a current NIST 800-171 self-assessment in SPRS. SPRS is the Supplier Performance Risk System, the DoD database where contractors post their cybersecurity scores. DFARS 252.204-7020 requires you to post the score before award. (DFARS 252.204-7019, DFARS 252.204-7020)

If none of your contracts carry these clauses, the rules do not bite yet. Watch your solicitations anyway, because new awards add the clauses routinely. If the clauses are there, keep going.

Day two: score yourself honestly

Run a NIST 800-171 self-assessment. NIST 800-171 Revision 2 holds 110 requirements grouped into 14 control families. The DoD scoring method starts you at 110 points and subtracts for each requirement you do not meet. (NIST SP 800-171 Revision 2, NIST SP 800-171A)

Score each requirement as implemented, not implemented, or not applicable. A requirement marked not applicable needs a written reason. DoD gives the scoring guidance in NIST SP 800-171A, the assessment procedures for the control set. Be honest. A low score you can defend beats a high score an assessor later tears apart.

Small contractors usually land between minus and plus 30 on the first pass. That is normal. The score is a starting line, not a verdict.

Day three: start the system security plan

DFARS 252.204-7012 requires you to implement NIST 800-171 and to document it in a System Security Plan. The SSP is the document that describes your system and how each safeguard is implemented. NIST SP 800-18 Revision 1 is the guide for writing security plans. (NIST SP 800-18 Revision 1)

Do not write a novel. On day three, build the skeleton. List the system name and owner, the system boundary, the 110 requirements as a checklist, and your status for each. You will fill the details in over the coming weeks. The skeleton turns the problem from vague to concrete.

For every requirement you scored not implemented, open a POA&M entry. POA&M is the Plan of Action and Milestones, the list of open weaknesses with owners and target dates. The POA&M is how you show a plan instead of a problem.

Day four: post your score to SPRS

Create your SPRS account at the PIEE portal if you do not have one. PIEE is the Procurement Integrated Enterprise Environment, the DoD portal that hosts SPRS. Post your basic self-assessment score. Your entry needs your company details, your score, the date of the assessment, and the SSP completion date.

Posting matters for two reasons. First, DFARS 252.204-7020 makes a current score a condition of award. No posted score means no new contracts with the clause. Second, the posted score starts the clock on keeping your evidence current.

Day five: spend where it counts first

With your score and SSP skeleton in hand, fix the cheapest high value items first. For most small contractors, that means:

Multi factor authentication everywhere. MFA is multi factor authentication, a second proof of identity beyond a password. NIST 800-171 requirement 3.5.3 requires it twice over. It covers network access to non privileged accounts and local access to privileged accounts. It costs little and closes real risk.

Centralized logging. Requirement 3.3.1 asks for audit records of system activity. Turn on logging in every cloud account and pull it into one place. You cannot defend a score without logs.

Access reviews. Requirement 3.1.1 asks you to limit system access to authorized users. Review who has access to CUI systems this week and remove the stale accounts. Every former employee with an active login is a finding waiting to happen.

The traps to avoid

Do not hire before you score. Consultants are useful later. A paid gap assessment on an unscored company is expensive. Day two teaches you the same lesson for free.

Do not wait for CMMC to start. CMMC Level 2 builds on NIST 800-171, the same controls this week covers. DFARS obligations exist now, independent of any CMMC timeline. Work done this week counts toward both.

Do not confuse tools with compliance. Buying a security tool does not implement a requirement. Configuring it, documenting it, and producing evidence does.

Next step

PolicyCortex collects evidence from live Azure configuration using 33 collectors. The collectors read conditional access, diagnostic settings, Defender posture, backup, and firewall. The evidence is evaluated against NIST 800-53 and NIST 800-171. It supports re-verification after remediation. It generates SSP, SAR, and POA&M output from collected evidence. SSP means System Security Plan. SAR means Security Assessment Report. PolicyCortex is strongest in commercial Azure, and AWS is covered. Start at https://policycortex.com.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, acquisition.gov. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
• DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, acquisition.gov. https://www.acquisition.gov/dfars/252.204-7019-notice-nist-sp-800-171-dod-assessment-requirements
• DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, acquisition.gov. https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171-dod-assessment-requirements
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, National Institute of Standards and Technology, February 2020. https://doi.org/10.6028/NIST.SP.800-171r2
• NIST SP 800-171A Revision 2, Assessing CUI Requirements, National Institute of Standards and Technology, January 2022. https://doi.org/10.6028/NIST.SP.800-171Ar2
• NIST SP 800-18 Revision 1, Guide for Developing Security Plans for Federal Information Systems, National Institute of Standards and Technology, February 2006. https://doi.org/10.6028/NIST.SP.800-18r1