DFARS (Defense Federal Acquisition Regulation Supplement)
The DoD-specific supplement to the FAR that adds defense-unique acquisition requirements applicable to all Department of Defense contracts.
The Defense Federal Acquisition Regulation Supplement (DFARS) is the Department of Defense's supplement to the Federal Acquisition Regulation. It contains policies, procedures, contract clauses, and solicitation provisions unique to DoD acquisitions. Any company pursuing DoD contracts must understand DFARS requirements in addition to the base FAR.
Relationship to the FAR
The DFARS does not replace the FAR. It supplements it. Both apply to DoD contracts. When the DFARS and FAR address the same topic, the DFARS provision typically takes precedence for DoD acquisitions. Non-DoD agencies have their own supplements (GSAM for GSA, HHSAR for HHS) but none is as extensive as DFARS.
Key DFARS Requirements
DFARS Part 252 contains hundreds of contract clauses and solicitation provisions specific to defense acquisitions. Key areas include cybersecurity and information protection (DFARS 252.204-7012 for safeguarding covered defense information), supply chain security, counterfeit parts prevention, specialty metals restrictions, Buy American requirements for defense items, and requirements related to foreign military sales and international cooperative programs.
DFARS 252.204-7012 and CUI
DFARS 252.204-7012 requires contractors handling Covered Defense Information (CDI) to implement the 110 security controls in NIST SP 800-171 and to report cyber incidents to DoD within 72 hours. This clause is the foundation for the CMMC framework and applies to virtually all DoD contractors who handle sensitive technical data, requirements, or operational information.
DFARS Waivers and Deviations
Agencies can request waivers of DFARS requirements when compliance is not practical. However, these are rarely granted for foundational requirements like cybersecurity. Contractors should not assume a waiver will be available and should plan for DFARS compliance from the beginning of any DoD pursuit.
Frequently asked questions
Does DFARS apply to all DoD contractors?
DFARS applies to all DoD contracts, though specific clauses are incorporated based on the nature of the work. DFARS 252.204-7012 regarding safeguarding covered defense information is one of the most widely incorporated clauses, applying to any contractor that processes, stores, or transmits information designated as Covered Defense Information.
What is the most important DFARS clause for cybersecurity?
DFARS 252.204-7012 is the foundational cybersecurity clause for defense contractors. It requires implementation of NIST SP 800-171 security controls, 72-hour incident reporting to DoD, and cloud service provider compliance with FedRAMP Moderate or equivalent. This clause is the precursor to and foundation for the CMMC framework.