What is DFARS 252.204-7012?

DFARS 252.204-7012 is a United States Department of Defense (DoD) regulation that outlines safeguarding covered defense information and cyber incident reporting. It mandates specific security requirements for contractors who handle covered defense information (CDI) on their unclassified information systems. The rule requires contractors to implement the security requirements outlined in NIST Special Publication 800-171, 'Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,' and to report cyber incidents that affect CDI. Its commonly used by DoD contractors to ensure the confidentiality, integrity, and availability of CDI.