Protection of Defence Information: DFARS, CMMC and Requirements for US Department of War Contractors

Imagine a company that develops software, maintains equipment or supplies individual components for a US defence contract. It does not develop classified military technologies and has no access to state secrets. Nevertheless, its servers may store technical documents, information on contract performance or other information whose disclosure could harm US defence interests. Consequently, even seemingly ordinary commercial activities may require compliance with specific cybersecurity rules.

For companies seeking to enter the US defence market, this means that the quality of products or services is only one part of the requirements imposed on prospective contractors. It is equally important to understand what information they will receive, how they must protect it and how they will demonstrate compliance with the applicable requirements. These obligations may apply not only to the party directly performing a government contract, but also to companies involved in its performance.

This article examines how the DFARS framework, the requirements of NIST SP 800-171 and the CMMC programme establish rules for protecting defence information and what these rules mean for US Department of War contractors and subcontractors.

The Legal Framework Governing Defence Information

US legislation and national standards establish a differentiated approach to protecting defence information. Understanding the distinctions between the various categories of information is important for determining the legal regime applicable to such information and, consequently, the applicability of the relevant protection requirements. Incorrectly determining the applicable legal regime may result either in excessive expenditure on compliance for information that does not require such a level of protection or in inadequate protection of data subject to stringent statutory requirements and the requirements of a cybersecurity certification programme (CMMC).

Several specific categories of data subject to enhanced protection are distinguished:

1. Federal Contract Information (FCI): information not intended for public disclosure that is provided by the Government or generated for it in connection with a contract for the development or supply of products or the provision of services. Examples include order performance reports, technical correspondence and internal contract documents. Such information is subject to basic protection against unauthorised access and disclosure.

The requirements for protecting FCI are incorporated into the terms of the contract. Compliance is required by the government customer and monitored through ordinary federal procurement procedures, oversight by the government contracting officer and the defence industrial base security systems. There is no separate supervisory authority for FCI. The contractor demonstrates compliance with the applicable requirements through a self-assessment, the results of which are entered annually into the Supplier Performance Risk System (SPRS) and confirmed by a declaration from the company’s responsible officer.

2. Controlled Unclassified Information (CUI): information that is not classified but is sensitive to the Government for certain reasons. It may be provided by the Government or generated by a contractor on behalf of the Government under a contract. Examples include certain technical data concerning military equipment and data subject to export controls.

Under Executive Order No. 13556, the US National Archives and Records Administration (NARA) is the authority responsible for implementing the CUI programme and overseeing compliance with it. In practice, this work is managed by the CUI Office and the Information Security Oversight Office (ISOO).

CUI is further divided into two levels according to the applicable handling requirements:

• CUI Basic is subject to uniform federal regulatory requirements. This is information for which the law does not establish specific protection requirements. Examples may include financial records or procurement documentation.
• CUI Specified is subject to additional or more stringent requirements established by the law or regulation underlying the relevant category. It is marked with the prefix “SP”, for example, CUI//SP-CTI, which relates to Controlled Technical Information. DFARS 252.204-7012 defines such information as technical information with military or space applications for which restrictions have been imposed on access, use, reproduction, modification, performance, display, release, disclosure or dissemination. Under 10 U.S.C. § 130, such information includes drawings, diagrams, plans, instructions, computer software and documentation that may be used for the design, engineering, production, manufacture, operation, repair, overhaul or reproduction of military or space equipment.

CUI is a nationwide concept in the United States and encompasses various categories of controlled unclassified information, extending beyond the defence sector.

Within US Department of War defence contracts, the term Covered Defense Information (CDI) is used. CDI includes, in particular, CUI that meets the definition and conditions set out in DFARS 252.204-7012.

Thus, FCI comprises non-public data related to the performance of a government contract, whereas CUI is a distinct and more sensitive category comprising data that legislation specifically requires to be protected, even though it is not classified. It is also important to note that not every contract with the US Department of War will involve the processing of CUI. For example, contracts involving the procurement of ready-made commercial products or contracts requiring minimal technical involvement by suppliers in the development of defence systems will most likely involve FCI only.

3. Classified Information (CI): Information assigned a security classification under Executive Order No. 13526 because its unauthorised disclosure could harm US national security. Depending on the degree of potential harm, such information is divided into three levels: Confidential, Secret and Top Secret.

Access to classified information by contractors requires compliance with specific security requirements. In particular, the facility and its employees involved in the relevant work must hold the appropriate clearance, known as a Facility Security Clearance (FCL). The clearance process is administered by the US Defense Counterintelligence and Security Agency (DCSA). The requirements governing the classification of information and the handling of classified material under a particular contract are specified in DD Form 254 (Contract Security Classification Specification).

In addition to FCI, CUI and CI, several other legal regimes should be taken into account, as they operate alongside these categories and may affect how information is stored, transferred and made accessible. The International Traffic in Arms Regulations (ITAR) regulate defence articles and related technical data and may impose strict restrictions on who may access them, including foreign persons. Accordingly, ITAR affects internal policies, system boundaries and the selection of suppliers. The Export Administration Regulations (EAR) operate similarly but concern the export of goods, software and technology, including dual-use items. Data subject to export controls often also falls within CUI, meaning that several regulatory regimes may apply simultaneously.

Regulatory and Contractual Requirements for the Protection of Defence Information

Requirements for protecting information in US Department of War procurement are determined during the procurement preparation stage and incorporated into procurement documentation and the contract.

They affect the conditions under which companies may participate in procurement and the obligations of the selected contractor during contract performance. In particular, where a specific procurement requires Cybersecurity Maturity Model Certification (CMMC), the contractor must hold the appropriate status confirming its level of information protection in order to be awarded the contract. Therefore, before submitting a bid, a company must determine what information it will handle, what protection requirements are stipulated in the procurement documentation and whether it is capable of meeting them.

General Information Protection Requirements: FAR

The general regulatory framework for federal procurement in the United States is established by the Federal Acquisition Regulation (FAR). FAR 52.204-21, “Basic Safeguarding of Covered Contractor Information Systems”, establishes 15 basic security requirements for contractor information systems in which FCI is stored, processed or transmitted:

• Access control: granting access to information systems only to authorised users, processes and devices, and restricting their activities in accordance with their assigned permissions.
• Identification and authentication: establishing the identities of users and devices and verifying their credentials before granting access.
• External connection control: verifying and restricting connections to external information systems.
• Physical security: restricting physical access to information systems, equipment and premises, and controlling visitor access.
• Communications protection: monitoring and protecting information transmitted across external and designated internal network boundaries.
• Vulnerability management: identifying information system deficiencies in a timely manner, reporting them and remedying them.
• Protection against malicious software: using and updating anti-malware tools and periodically scanning systems and files.
• Secure handling of media: sanitising or destroying media containing FCI before disposal or reuse.

These requirements establish a basic level of protection for FCI and do not preclude the application of additional information protection requirements.

In particular, where information constitutes CUI and falls within the scope of the relevant defence contract requirements, it must also be protected in accordance with specific provisions, including DFARS 252.204-7012.

Specific Requirements for Defence Information: DFARS

For US Department of War procurement, the Defense Federal Acquisition Regulation Supplement (DFARS) applies alongside FAR. In essence, DFARS supplements FAR by establishing specific rules and contractual requirements for defence procurement.

DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting”, establishes contractual requirements for protecting CDI and reporting cyber incidents. In particular, this provision imposes the following principal obligations on contractors:

• Protection of information systems: implementing appropriate security measures for systems in which CDI is processed, stored or transmitted.
• Cyber incident reporting: notifying the US Department of War of a cyber incident falling within the scope of the provision within 72 hours of its discovery.
• Preservation of evidence: retaining and safeguarding relevant data and media for subsequent investigation of the incident.
• Cloud service requirements: if a contractor uses a cloud service (for example, AWS, Microsoft Azure, or Google Cloud) to store, process, or transmit sensitive defense information (CDI), that service must meet security requirements at the FedRAMP Moderate level. This is a federal security standard for cloud services with a medium level of stringency. In addition, the contractor is required to comply with the cyber incident and data breach response rules established by DFARS 252.204-7012, including promptly notifying the customer of an incident and preserving data for investigation.

If, however, the subject of the contract itself is the provision of cloud services to the US Department of War, additional requirements may apply to the provider. These are set out in the DoD Cloud Computing Security Requirements Guide (SRG).

It divides cloud services into Impact Levels (IL) depending on how sensitive the data to be stored there will be. The specific level required is stated in the terms of the particular procurement.

For the practical implementation of these requirements, DFARS 252.204-7012 provides for the application of the NIST standard developed by the US National Institute of Standards and Technology (NIST), namely NIST SP 800-171. This standard specifies requirements for protecting information systems and establishes concrete security measures, including those relating to access control, authentication, monitoring and cyber incident response.

NIST SP 800-171 Revision 2 contains 110 requirements grouped into 14 security families, covering, in particular:

• access control for information and information systems;
• identification and authentication of users;
• employee information security awareness and training;
• system event logging and analysis;
• configuration management and technical changes;
• cyber incident response;
• system maintenance and media protection;
• physical protection of equipment and premises;
• risk assessment and evaluation of the effectiveness of security measures;
• communications protection and information integrity.

Note. NIST SP 800-171 Revision 2 has been superseded by NIST SP 800-171 Revision 3. However, for most contractors, the requirements of NIST SP 800-171 Revision 2 still apply for now. The exact version of the requirements that applies is set out in the terms of the procurement.

Compliance Assessment and the CMMC Programme

Where DFARS establishes contractual requirements for protecting defence information and NIST SP 800-171 specifies the relevant security requirements, the CMMC is a programme for assessing and confirming that contractors in the US defence industrial base comply with the aforementioned requirements.

CMMC requirements are incorporated into defence contracts through the relevant DFARS provisions. The documentation for a particular procurement specifies the required CMMC level that the contractor must achieve and maintain. Therefore, before submitting a bid, a company should verify not only the cybersecurity requirements but also the compliance status it must demonstrate to enter into the contract.

At the current stage of the programme, as of October 2026, two levels involving self-assessment are provided for:

1. Basic protection of FCI. The contractor conducts an annual self-assessment to determine whether it complies with the 15 security requirements specified in FAR 52.204-21(b)(1)(i)–(b)(1)(xv) and confirms its compliance. The assessment results and confirmation are entered into the US Department of Defense system for recording relevant supplier information (SPRS).

2. Enhanced protection of CUI. The contractor assesses its compliance with the 110 security requirements of NIST SP 800-171 Revision 2, referenced in DFARS 252.204-7012, once every three years. In addition, it must confirm its compliance annually and enter the relevant information into SPRS. If deficiencies are identified during the assessment, the contractor may, subject to certain conditions, prepare a Plan of Action and Milestones (POA&M), setting out the measures required to remedy the deficiencies and the deadlines for their completion. The deficiencies must be remedied within 180 days. Until this process is completed, the contractor may hold a conditional compliance status.

Extension of Requirements to Subcontractors

Requirements for protecting defence information are not limited to the company that has entered directly into a contract with the US Department of Defense. They may also extend to subcontractors involved in performing that contract. This is achieved through the “flow-down” mechanism, whereby the relevant contractual requirements are passed down to lower tiers of the supply chain by incorporating them into subcontracting agreements.

For example, if a subcontractor receives access to FCI or stores it in its own information systems while performing the work, the prime contractor must incorporate the requirements of FAR 52.204-21 into the subcontract. If the subcontractor handles CDI, the requirements of DFARS 252.204-7012 must be incorporated into the subcontract, including the obligations to protect such information and report relevant cyber incidents. These requirements apply subject to the conditions and exceptions provided for in the respective provisions.

The same approach applies to CMMC. Where the relevant programme requirements extend to a subcontractor, that subcontractor must hold the required level of compliance. It is therefore important for the prime contractor to take information protection requirements into account when selecting subcontractors and entering into agreements with them.

Conclusions

The US defence sector offers businesses opportunities for long-term cooperation and participation in strategically important projects. At the same time, it is a market with stringent security requirements, where underestimating cyber risks may cost a company considerably more than implementing appropriate protective measures. The consequences may include the loss of a contract or the opportunity to participate in future procurement, financial claims and legal liability.

An effective protection framework requires not only technical measures but also the proper organisation of internal processes, oversight of subcontractors and consideration of other applicable legal regimes. Preparing in advance to meet these requirements enables companies to avoid difficulties during contract performance, strengthen the confidence of government customers and improve their prospects for further cooperation in the US defence sector.