The clause names one control set. Everything else follows from 800-171.
DFARS 252.204-7012 is the clause most defense contracts carry. It requires you to safeguard covered defense information to NIST SP 800-171, report incidents within 72 hours, and hold that data in a FedRAMP Moderate cloud. Read it once and the rest of the program stops being mysterious.
Three obligations, and a fourth that catches people out.
First, implement the 110 controls across 14 families — access, audit, configuration, incident response, and the rest — and document how each is met in a System Security Plan. Second, report any cyber incident affecting CDI to DoD within 72 hours of discovery. Third, run in a cloud that meets FedRAMP Moderate; a service authorized on the Marketplace satisfies this directly.
The fourth: the clause flows down. Every subcontractor who touches CDI inherits 7012 too — which is how a prime's requirement becomes yours, often with a date already attached.
Four clauses, not one. They travel together in your contract.
Build to Rev 2 — even though Rev 3 is published.
NIST released 800-171 Rev 3 (97 requirements, 17 families), but CMMC and DoD still assess against Rev 2's 110 controls under a 2024 class deviation. Building to Rev 3 today means preparing for an assessment that isn't scored against it yet. We build to Rev 2, track Rev 3, and design the boundary so the eventual move is an adjustment, not a rebuild.
Have the 7012 clause in a contract?
A readiness check reads your actual clause and maps your current cloud to the 110 controls.