What Do the Latest DoD Security Requirement Changes Mean for Contractors?
DoD clauses apply to covered contractor systems, current NIST SP 800-171 assessments, SPRS postings, and cloud security controls when cloud services are used.
AI-assisted and automatically checked against the linked primary sources.
Which contractors are affected?
According to DFARS 252.204-7012, a covered contractor information system is an unclassified system owned or operated by or for a contractor that processes, stores, or transmits covered defense information. DFARS 252.204-7020 says the assessment requirements apply to covered contractor information systems that are required to comply with NIST SP 800-171. For award consideration, DFARS 252.204-7019 states that if the offeror is required to implement NIST SP 800-171, the offeror must have a current assessment that is not more than 3 years old unless the solicitation sets a shorter period, and that assessment must cover each relevant covered contractor information system tied to the offer, contract, task order, or delivery order. The clauses also connect those assessments to SPRS. DFARS 252.204-7020 distinguishes basic assessments from medium and high assessments, with basic assessments being contractor self-assessments and medium and high assessments being conducted by the Government. DFARS 252.204-7020 also allows rebuttal of Medium and High Assessment summary scores before posting, and gives the contractor 14 business days after completion of each assessment to provide additional information or rebut findings.
What changes for assessment requirements?
What should small businesses review?
Small businesses should review whether their work involves covered contractor information systems, whether those systems process, store, or transmit covered defense information, and whether NIST SP 800-171 applies under DFARS 252.204-7012 and 252.204-7020. They should also review their SPRS status, because the clauses require current assessment scores to be posted or submitted for posting. If cloud computing is used to provide information technology services in performance of the contract, DFARS 252.239-7010 adds separate requirements: the contractor must obtain Contracting Officer approval before using cloud services when the offer said cloud was not anticipated, must implement and maintain the required safeguards under the Cloud Computing Security Requirements Guide unless waived, must keep non-DoD-premises Government data in the United States or outlying areas unless written approval says otherwise, and must report cloud-related cyber incidents to DoD.
- The cited DFARS rules apply to covered contractor information systems that must comply with NIST SP 800-171.
- Award consideration can depend on a current assessment that is not more than 3 years old unless the solicitation sets a shorter period.
- Basic assessments are contractor self-assessments; medium and high assessments are Government assessments and are tied to SPRS posting.
- Cloud computing adds separate security, data-location, and cyber incident reporting requirements under DFARS 252.239-7010.
Review whether your contracts involve covered contractor information systems, current SPRS assessment status, and any cloud computing use under the cited DFARS clauses.
Important Note
DFARS 252.204-7020 allows the contractor to receive Medium and High Assessment summary scores and rebut them before SPRS posting, and gives 14 business days after each assessment to provide additional information or rebut findings.
Sources & Citations
Related Articles
What Should Contractors Review in CISA’s AI Procurement Guidance?
CISA’s procurement guidance says buyers should review product security, incident response, data protection, and supply chain risk—not just enterprise compliance.
Read more →What Compliance Questions Arise When a U.S. Weapons Program Moves Overseas?
Foreign production can trigger DFARS foreign-license, export-control, patent/data-rights, and overseas-performance questions, plus ITAR and EAR compliance duties.
Read more →How Should Small Business Contractors Prepare for a GSA Multiple Award Schedule Refresh?
Review the solicitation-level SF30, compare any contract-level mass modification, use the MAS Modification Guide and clause matrix, and confirm the right guide.
Read more →