Question · DFARS 252.204-7012
Does DFARS 252.204-7012 apply to AI systems handling CUI?
The clause requires 'adequate security' for covered defense information, meaning NIST SP 800-171 on contractor systems, and rapid reporting of cyber incidents to DoD.
01 / The answer
The short answer
Yes. If a contractor's AI system processes, stores or transmits covered defense information, it is a covered contractor information system under DFARS 252.204-7012. It must meet NIST SP 800-171 (DoD's 2024 class deviation specifies Rev. 2), and cyber incidents affecting it must be reported to DoD through DIBNet within 72 hours, with affected images kept for at least 90 days. If the AI runs as an external cloud service, the provider must meet security equivalent to the FedRAMP Moderate baseline. The July 2026 CMMC Phase 2 suspension did not change these duties.
02 / The rule
What DFARS 252.204-7012 requires
The clause requires 'adequate security' for covered defense information, meaning NIST SP 800-171 on contractor systems, and rapid reporting of cyber incidents to DoD. It is the baseline that CMMC assesses and it stayed in force when CMMC Phase 2 was suspended in July 2026.
- 01Implement NIST SP 800-171 on covered contractor systems; DoD's class deviation holding contractors to Rev. 2 (2024-O0013, Revision 1) says it stays in effect until rescinded.
- 02Ensure external cloud providers storing covered defense information meet security equivalent to the FedRAMP Moderate baseline.
- 03Report cyber incidents to DoD via DIBNet within 72 hours of discovery.
- 04Submit discovered malicious software to the DoD Cyber Crime Center (DC3).
03 / Records
Records to keep
- 01System security plan and NIST SP 800-171 assessment
- 02SPRS basic assessment score
- 03Cloud provider FedRAMP Moderate (or equivalent) documentation
- 04Incident reports, DIBNet report numbers and 90-day image retention logs
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Holland & Knight
RELATED
Related: DFARS 252.204-7012: the full guide