DFARS 252.204-7012 in the FAR overhaul: the same number under the deviation

DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. Same number in the deviation text, as the DoD class deviation lists it; confidence high. As at 27 Sep 2026.

Codified252.204-7012eCFR, clause dated MAY 2024

Under the deviationsame numberClass Deviation 2026-O0025, Revision 3 (DFARS Part 240)

Proposed permanent numberno DFARS proposed rule in the Federal Register

Kept means same number in the deviation text.

Sources last checked 27 Sep 2026 (dataset version 1). What changed and when. An existing contract's clauses are not rewritten by a later deviation or proposed rule; they change only by modification.

What the source says changed

No official source in the set states what changed in the text; the number and title are as listed.

Why this disposition

252.204-7012 appears with its clause text in the DoD RFO class deviation attachment for DFARS Part 240 (Part-240__2026-O0025_Rev3_TAB_A1_DFARS_Part_240); relocated from DFARS part 204 to part 240

Confidence: high. Read from an official table or the deviation or rule text itself.

Titles and where each is prescribed

codified: Safeguarding Covered Defense Information and Cyber Incident Reporting
under the deviation: Safeguarding Covered Defense Information and Cyber Incident Reporting
prescribed at 204.7304(c) (codified); 240.370-5(c) (deviation text)

Which agencies

DoD only. Class Deviation 2026-O0025, Revision 3 (DFARS Part 240), issued 3 September 2026; each DFARS deviation attachment is used in lieu of 48 CFR chapter 2. Confirm which deviation your contracting officer's agency has adopted.

Subcontractors

Tracking which subcontractors have declared a current SPRS assessment for this clause: Subcontractor CMMC Tracker

What flows down

Under the DFARS class deviation: flows down under its own paragraph (m). The Contractor shall- (1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and (2) Require subcontractors to- (i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and (ii) Provid
Commercial products and services: included. COTS items: not stated in the paragraph. What goes down: the clause itself. DoD RFO class deviation file: 2026-O0025_Rev3_TAB_A1_DFARS_Part_240.docx 3 September 2026
Codified text (eCFR): flows down under its own paragraph (m). The Contractor shall- (1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and (2) Require subcontractors to- (i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and (ii) Provide th
Commercial products and services: included. COTS items: not stated in the paragraph. What goes down: the clause itself. 48 CFR part 252 (codified DFARS clauses) current to 24 Sep 2026 (issue 18 Sep 2026)

Sources, with their dates

48 CFR part 252 (codified DFARS clauses) current to 24 Sep 2026 (issue 18 Sep 2026), clause dated MAY 2024
DoD RFO class deviation file: 2026-O0025_Rev3_TAB_A1_DFARS_Part_240.docx 3 September 2026

Questions

What is DFARS 252.204-7012 called after the FAR overhaul?

DFARS 252.204-7012 in the FAR overhaul: the same number under the deviation. The codified number is 252.204-7012; the deviation text lists 252.204-7012; no DFARS proposed rule in the Federal Register. As at 27 Sep 2026.

Which number does a contract carry for DFARS 252.204-7012 after the FAR overhaul?

Which number a given contract carries depends on the deviation the contracting agency has adopted and the date of the solicitation or modification. DoD only: Class Deviation 2026-O0025, Revision 3 (DFARS Part 240). Confirm which deviation your contracting officer's agency has adopted.

Is the change to DFARS 252.204-7012 final?

No final FAR overhaul rule had been published in the Federal Register as at 27 Sep 2026. No DFARS proposed rule in the Federal Register.

Read your whole list: run 252.204-7012 in the finder, or paste every clause of a contract, flow-down exhibit or template on the landing page. As at 27 Sep 2026.