How to Read the DFARS Clauses in a Purchase Order Before You Sign It

Where do DFARS clauses hide in a purchase order?

Most small suppliers never see the full text of a DFARS clause in their orders. Primes and higher-tier subcontractors usually include clauses "by reference," which means the order lists a clause number and a date, and the full text lives in the regulation itself. You will often find them in one of these places:

• A terms and conditions document attached to or linked from the purchase order
• A flowdown matrix or table listing FAR and DFARS clauses, often with notes such as "applies if the order involves covered defense information"
• A quality or supplier requirements section that also covers inspection and documentation
• The face of the purchase order itself, in a short block of clause numbers

Each reference usually reads like a clause number followed by a month and year in parentheses. That date identifies the version of the clause. Pull the exact version from acquisition.gov and read it, because the wording has changed over time and your obligations follow the version in your order.

If the order says "the following clauses apply if applicable" and gives no further detail, treat that as a question to ask, not an answer.

Which clause numbers should make me stop and read before signing?

A handful of clauses carry most of the cybersecurity weight in defense orders. Here is what each one asks of you in plain terms.

1. FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. This applies when you handle Federal Contract Information, meaning information not intended for public release that is provided by or generated for the government under a contract. It requires a set of basic safeguarding requirements on the systems that hold that information.
2. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. This is the clause that brings in NIST SP 800-171 for systems that process, store or transmit covered defense information. It also requires you to report cyber incidents to the Department of War within 72 hours of discovery through the DIBNet portal, which requires a medium assurance certificate, and to preserve images of affected systems for 90 days. If you use a cloud provider for covered defense information, the clause sets requirements for that provider too. It must be flowed down to your own subcontractors when their work involves covered defense information.
3. DFARS 252.204-7019 and 252.204-7020, the NIST SP 800-171 DoD Assessment requirements. Together these require a current assessment score posted in the Supplier Performance Risk System (SPRS), no more than three years old, and they require you to give the government access for a higher-level assessment if it asks. Under 7020, a contractor is not supposed to award a subcontract that is subject to 7012 unless the subcontractor has a current assessment on file.
4. DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, along with its solicitation provision, 252.204-7025. The 7021 clause took effect November 10, 2025. It requires you to hold a current CMMC status at the level the contract specifies for the information systems that handle Federal Contract Information or CUI, to maintain that status for the life of the contract, to have an affirming official submit affirmations in SPRS, and to notify the contracting officer within 72 hours of any lapse in information security or change in CMMC status. It must be flowed down to subcontractors at the level appropriate to the information they will receive.

If your order includes 7021, look for the stated level and assessment type. "Level 1 (Self)," "Level 2 (Self)," "Level 2 (C3PAO)" and "Level 3 (DIBCAC)" are very different commitments, and the difference changes who assesses you and what you need on file.

How do I tell whether this order actually involves CUI?

Clauses tell you what applies if certain information is involved. The information itself tells you whether it is. Look at what the prime will actually send you to do the work:

• Technical drawings, models or specifications, especially ones carrying a distribution statement other than "approved for public release"
• Documents marked CUI or carrying legacy markings such as For Official Use Only
• Export-controlled technical data
• Statements of work that describe a defense program or end use in detail

A restrictive distribution statement on a drawing is a strong signal that you will be handling controlled technical information, which is a category of CUI. That is the point where 7012 and NIST SP 800-171 stop being theoretical.

If the order lists 7012 but the prime says you will never receive covered defense information, get that in writing. If the order lists only FAR 52.204-21 but the drawing package arrives with restrictive markings, the information has outrun the paperwork, and that mismatch needs to be resolved with the prime before work starts. Whether a given document is CUI is a determination the government and the prime make, not something you should guess at.

What will an assessor ask me to show for these clauses?

This is the part that turns a clause into a workload. An assessor or a prime's supplier review will start from the contract and work backward to your evidence. Expect to be asked for:

• The contract or purchase order itself, showing which clauses and which CMMC level apply
• A description of where the covered information enters your company, where it is stored and who touches it, which defines the boundary of what gets assessed
• Your System Security Plan describing how each NIST SP 800-171 requirement is met within that boundary
• Your current SPRS score and the date it was submitted, plus any Plan of Action and Milestones for open items where the rules allow them
• Your CMMC status and the affirmation records submitted by your affirming official, where 7021 applies
• Your incident response process, showing how you would detect an incident, obtain or use your medium assurance certificate and report within 72 hours
• Evidence that your cloud or email provider meets the requirements 7012 sets for covered defense information
• Proof that you flowed the same clauses down to any subcontractor who receives covered information from you

Notice that several of these items reach outside your IT systems. The purchase order, the flowdown to your own suppliers and the name of your affirming official are contract and management records. A supplier that signed without reading the clauses often discovers this gap only when the evidence request arrives.

What should I ask the prime before I sign?

You are allowed to ask questions about an order before accepting it, and good primes expect them. Put your questions in writing and keep the answers with the purchase order file. Useful questions include:

1. Which of the listed cybersecurity clauses apply to this specific order, and which are included only in case they become applicable?
2. Will you send us any CUI or covered defense information under this order, and if so, what kind?
3. If 7021 applies, what CMMC level and assessment type does this order require?
4. Do you need our SPRS score or CMMC unique identifier before award, and by what date?
5. Who at your company should we contact if we need to report a cyber incident or a change in our CMMC status?
6. Is there a way to perform this work without receiving the controlled data, for example by working from a sanitized drawing?

That last question matters. Sometimes the cheapest compliance decision is keeping controlled information out of your environment entirely. Sometimes the work truly requires the data, and then the answer shapes how you set up the systems that will hold it.

Sources

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
• DoD CIO, Cybersecurity Maturity Model Certification program
• NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems
• DIBNet, Defense Industrial Base cyber incident reporting portal
• Interweave Technologies, Who Needs to Comply with CMMC Across Government Contracting
• CMMC Audit Preparation, Does My Organization Handle CUI?
• Kiteworks, CMMC Compliance for Armament Manufacturers