Compare

DFARS 252.204-7012 vs CMMC: how they differ, side by side

How DFARS 252.204-7012 and CMMC differ: what each is, who owes it, when it applies and who enforces it.

DFARS 252.204-7012Binding on DoD contractors through contract

CMMCBinding on DoD contractors through contract

Checked21 Oct 2026

01 / Side by side

DFARS 252.204-7012 and CMMC, side by side

	DFARS 252.204-7012	CMMC
What it is	contract clause	regulation
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding on DoD contractors through contract	Binding on DoD contractors through contract
Status	In force	Partly in force
Applies from	31 Dec 2017	10 Nov 2025
Who owes it	DoD contractors and subcontractors whose information systems process, store or transmit covered defense information, or that provide operationally critical support.	Defense contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor systems.
Enforcement	DoD contracting officers through contract remedies (termination, withholding, exclusion); misrepresented compliance can bring False Claims Act liability. No fixed fines in the clause.	DoD contracting officers (no award without required status); false affirmations can bring False Claims Act liability (treble damages plus per-claim penalties) and suspension or debarment.

02 / DFARS 252.204-7012

What DFARS 252.204-7012 requires

Applies to AI systems as to any system: putting covered defense information into an AI tool or external AI cloud service brings that service into scope, including the FedRAMP Moderate equivalency requirement for cloud providers.

01Implement NIST SP 800-171 on covered contractor systems; DoD's class deviation holding contractors to Rev. 2 (2024-O0013, Revision 1) says it stays in effect until rescinded.
02Ensure external cloud providers storing covered defense information meet security equivalent to the FedRAMP Moderate baseline.
03Report cyber incidents to DoD via DIBNet within 72 hours of discovery.
04Submit discovered malicious software to the DoD Cyber Crime Center (DC3).
05Preserve images of affected systems and relevant monitoring data for at least 90 days after reporting.
06Flow the clause down unaltered to subcontractors handling covered defense information.

03 / CMMC

What CMMC requires

Applies to AI systems as to any system: AI tools, models or cloud AI services that process FCI or CUI fall inside the assessed boundary and must meet the same controls.

01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
04Post results in SPRS and have a senior official affirm compliance annually.
05Give the contracting officer the CMMC unique identifiers (UIDs) for systems handling FCI or CUI and report any changes to them during performance (DFARS 252.204-7021(e), NOV 2025).
06Flow down the required CMMC level to subcontractors handling FCI or CUI.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES