The Federal Acquisition Regulation (FAR) is the baseline purchasing rulebook that applies to every executive branch agency, and the Defense Federal Acquisition Regulation Supplement (DFARS) is a Department of Defense overlay that adds military-specific requirements on top of the FAR. The practical difference between FAR vs DFARS comes down to who you’re selling to: sell to a civilian agency like the Department of Energy or NASA and you follow the FAR alone; sell to the Army, Navy, Air Force, or Space Force and you follow both at once.1Defense Acquisition Regulations System. Defense Federal Acquisition Regulation Supplement and Procedures, Guidance, and Information The DFARS never replaces the FAR. It tightens FAR rules where defense missions demand it and fills gaps the FAR leaves alone.
What the FAR Is
The FAR sits in Title 48, Chapter 1 of the Code of Federal Regulations and spans 53 parts covering the acquisition process end to end: commercial buying in Part 12, negotiated contracts in Part 15, small business set-asides in Part 19, cost principles in Part 31, terminations in Part 49.2Acquisition.GOV. Part 1 – Federal Acquisition Regulations System A contracting officer can run a procurement from planning through closeout without ever leaving the FAR.
One thing to clear up: the FAR does not govern every federal dollar. It applies to executive agency acquisitions, with certain carve-outs, and legislative and judicial branch purchases operate under their own rules.2Acquisition.GOV. Part 1 – Federal Acquisition Regulations System For civilian contractors dealing with agencies like GSA or HHS, though, the FAR is effectively the entire rulebook.3General Services Administration. Federal Acquisition Regulation
What the DFARS Adds
The DFARS lives in Title 48, Chapter 2, immediately after the FAR in the CFR.1Defense Acquisition Regulations System. Defense Federal Acquisition Regulation Supplement and Procedures, Guidance, and Information It supplements and implements FAR policies for the demands of military procurement, and it is issued under the authority of the Secretary of Defense with day-to-day oversight by the Under Secretary of Defense for Acquisition and Sustainment.4Acquisition.GOV. DFARS Part 201 – Federal Acquisition Regulations System
Where the FAR states a general rule, the DFARS often tightens it. Where the FAR is silent on a military-specific issue, the DFARS fills the gap. The biggest divergences show up in cybersecurity, domestic sourcing of materials, specialty metals restrictions, foreign military sales, and commercial item determinations.
The Numbering Systems Line Up
Federal regulations require every agency supplement to parallel the FAR in format, arrangement, and numbering.5eCFR. 48 CFR Part 1 – Federal Acquisition Regulations System DFARS Part 212 supplements FAR Part 12. DFARS Part 225 supplements FAR Part 25. When the DFARS covers a defense-specific topic with no FAR counterpart, it uses section numbers starting at 70 and above. Learn one system and you can navigate the other.
Who Follows Which
Companies selling to civilian agencies follow the FAR alone. Companies contracting with any Department of Defense component follow both the FAR and the DFARS at the same time, and that dual obligation reaches every military branch, including the Space Force.1Defense Acquisition Regulations System. Defense Federal Acquisition Regulation Supplement and Procedures, Guidance, and Information
Subcontractors don’t escape by holding a contract with a prime rather than the government. Both frameworks contain mandatory flow-down clauses. FAR 52.244-6 lists dozens of provisions primes must push into subcontracts for commercial products and services, covering whistleblower protections, prohibitions on certain telecommunications equipment, and supply chain security.6Acquisition.GOV. Subcontracts for Commercial Products and Commercial Services The DFARS adds its own flow-downs, particularly around cybersecurity. If you’re three tiers deep in a defense supply chain and handle controlled unclassified information, DFARS cybersecurity clauses still reach you.
Where the DFARS Is Meaningfully Stricter
Cybersecurity
This is where the gap between civilian and defense contracting is widest. Defense contractors who handle controlled unclassified information must implement the security controls in NIST Special Publication 800-171, which covers access control, incident response, and other requirements for nonfederal systems that store or process sensitive government data.7National Institute of Standards and Technology. NIST Special Publication 800-171 Rev 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
DFARS 252.204-7012 requires defense contractors to report a cyber incident affecting covered defense information or operationally critical contract performance to DoD within 72 hours of discovery through the DIBNet portal, and to preserve images of affected systems and relevant monitoring data for at least 90 days.8eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information No equivalent reporting obligation exists under the baseline FAR for civilian contracts.
DFARS 252.204-7020 layers assessments on top of the controls themselves, in three tiers: a Basic Assessment (contractor self-assessment scored at “Low” confidence), a Medium Assessment (a government document review), and a High Assessment (a government-led review with on-site verification). Contractors must provide access to facilities, systems, and personnel for Medium and High assessments when required, and a prime cannot award a subcontract involving NIST 800-171 requirements unless the subcontractor has completed at least a Basic Assessment within the preceding three years.9eCFR. 48 CFR 252.204-7020 – NIST SP 800-171 DoD Assessment Requirements
A third cybersecurity layer is on the way. The Cybersecurity Maturity Model Certification program, published as a final rule at 32 CFR Part 170, consolidates the previous five-level model into three certification levels and rolls out in phases. Phase 1, which began in late 2025, covers Level 1 and Level 2 self-assessments. Phase 2, starting one calendar year after Phase 1, requires third-party certification for most contractors handling controlled unclassified information at CMMC Level 2.10Federal Register. Cybersecurity Maturity Model Certification Program Scheduling a third-party assessor and remediating gaps takes months, so contractors who’ve relied on self-assessment need to move well before Phase 2 begins.
Domestic Sourcing: Berry Amendment and Specialty Metals
The Berry Amendment, codified at 10 U.S.C. 4862, prohibits DoD from spending appropriated funds on certain items unless they are grown, reprocessed, reused, or produced in the United States.11Office of the Law Revision Counsel. 10 USC 4862 – Requirement to Buy Certain Articles from American Sources; Exceptions Covered categories include food, clothing and its component materials, tents and tarpaulins, cotton and natural fiber products, synthetic and coated fabrics, wool, and hand or measuring tools. DFARS 225.7002-1 implements the restriction and applies it to both end products and components.12Acquisition.GOV. DFARS 225.7002-1 Restrictions
Civilian FAR contracts have domestic preference rules too, primarily through the Buy American Act, but the Berry Amendment is considerably more restrictive. A civilian agency buying fabric might accept a foreign-made product if the domestic alternative costs more than a certain threshold. Under the Berry Amendment, there is generally no price-based exception for covered items on defense contracts.
Separately, DFARS 252.225-7009 restricts articles containing specialty metals unless those metals were melted or produced in the United States or a qualifying country. The clause reaches high-alloy steels, nickel and cobalt alloys above certain composition thresholds, titanium and titanium alloys, and zirconium and zirconium alloys.13Acquisition.GOV. DFARS 252.225-7009 – Restriction on Acquisition of Certain Articles Containing Specialty Metals Supplying a military component with titanium or high-chromium steel means tracing the metal back to its melt source. Misrepresenting specialty metal origin can lead to debarment, termination, and criminal false-claims exposure.
Commercial Product Determinations
Both the FAR and DFARS allow the government to buy commercial products using the streamlined procedures in FAR Part 12. A “commercial product” under FAR 2.101 is broadly defined as a product customarily used by the general public or nongovernmental entities that has been sold, leased, or offered for sale to the public, and it extends to items that evolved from commercial products through technological advances or involve only minor modifications to meet government needs.14Acquisition.GOV. FAR 2.101 – Definitions
The DFARS adds documentation layers. For defense acquisitions above the simplified acquisition threshold, the contracting officer must make a written commerciality determination and put it in the contract file. If that determination relies on certain subcategories within the commercial product definition, approval one level above the contracting officer is required. If a prior commerciality determination exists but the contracting officer wants to switch to non-commercial procedures, the head of the contracting activity must review and approve that reversal within 30 days.15Acquisition.GOV. DFARS 212.102 – Applicability The extra scrutiny exists because commercial designation exempts contractors from many cost accounting standards and audit requirements that otherwise apply to defense work.
Flexibilities: Deviations and OTAs
Neither framework is absolute. Both permit deviations. An individual deviation affects a single contract action and can be authorized by the agency head. A class deviation affects multiple actions and triggers higher approvals: for civilian agencies, the head of the contracting activity must consult with the Civilian Agency Acquisition Council; for DoD, class deviations are processed and approved through the DFARS itself.16Acquisition.GOV. Subpart 1.4 – Deviations from the FAR
The bigger structural difference is Other Transaction Authority. Under 10 U.S.C. 4022, DoD can enter agreements for prototype projects without following FAR or DFARS procedures at all, provided one of several conditions applies: at least one nontraditional defense contractor or nonprofit research institution participates significantly, all significant non-government participants are small businesses or nontraditional contractors, at least one-third of the project cost comes from non-federal sources, or a senior procurement executive makes a written finding of exceptional circumstances.17Office of the Law Revision Counsel. 10 USC 4022 – Authority of the Department of Defense to Carry Out Certain Prototype Projects
Approval scales with dollar value. Projects above $100 million but not exceeding $500 million require a written determination from the head of the contracting activity. Projects above $500 million require senior procurement executive approval and 30 days’ advance notice to congressional defense committees. OTAs exist to bring innovative companies into the defense industrial base that would otherwise avoid the compliance overhead of traditional contracting. No equivalent authority exists on the civilian side at this scale.17Office of the Law Revision Counsel. 10 USC 4022 – Authority of the Department of Defense to Carry Out Certain Prototype Projects
Disputes: Same Statute, Different Forums
Disputes under both FAR and DFARS contracts follow the Contract Disputes Act. A contractor first submits a written claim to the contracting officer, and claims over $100,000 require certification that the claim is made in good faith, the supporting data are accurate, and the amount reflects the actual adjustment the contractor believes is owed.18Office of the Law Revision Counsel. 41 USC 7103 – Decision by Contracting Officer For claims of $100,000 or less, the contracting officer must decide within 60 days of a written request; for larger claims, the officer has 60 days to either decide or set a decision timeline. A missed deadline is a deemed denial the contractor can appeal.
Where you appeal depends on which framework governs. Defense contractors go to the Armed Services Board of Contract Appeals. Civilian contractors go to the Civilian Board of Contract Appeals. Either can alternatively sue in the U.S. Court of Federal Claims, but the forum choice is binding once made. The deadline is 90 days from receiving the contracting officer’s decision to appeal to a board, or 12 months to file in the Court of Federal Claims.19Office of the Law Revision Counsel. 41 USC 7104 – Contractors Right of Appeal from Decision by Contracting Officer Missing either window forfeits the right to challenge the decision, and that is where contractors most commonly lose recoverable money.
What Non-Compliance Costs
Failing to comply with either framework can result in termination for default, which shifts repurchase costs to the contractor and eliminates government liability for undelivered work.20Acquisition.GOV. 49.402-2 Effect of Termination for Default In more serious cases the government can pursue debarment. FAR 9.406-2 authorizes debarment for fraud in obtaining a contract, willful failure to perform, a history of unsatisfactory performance, false statements, or any offense showing a lack of business integrity.21Acquisition.GOV. Subpart 9.4 – Debarment, Suspension, and Ineligibility A debarred company loses eligibility for new federal contracts government-wide, not just with the agency that initiated the action. The stakes are the same under either framework; the DFARS simply gives the government more clauses through which a defense contractor can trip into them.