DFARS stands for the Defense Federal Acquisition Regulation Supplement, the set of procurement rules the Department of Defense layers on top of the government-wide Federal Acquisition Regulation (FAR) whenever it buys goods or services. If your company holds a DoD contract, supplies a company that does, or is thinking about bidding, DFARS almost certainly applies to you, and it brings stricter cybersecurity standards, domestic sourcing mandates, banned suppliers, and quality controls that reflect the national-security stakes of military work.
How DFARS Fits with the FAR
The FAR is the baseline rulebook for every federal agency that buys goods or services. DFARS supplements it with additional clauses the DoD considers necessary for defense acquisitions. Where the FAR sets a general rule, DFARS may tighten it, add reporting obligations, or impose entirely new requirements.
A contractor working on both civilian and defense contracts follows the FAR on all of them, then adds DFARS whenever the DoD is the customer. DFARS is codified in Title 48 of the Code of Federal Regulations, Chapter 2, and the DoD updates it regularly through interim and final rules published in the Federal Register.
Who Has to Comply
Every company holding a prime contract with the DoD is covered. That part is obvious. What surprises many businesses is that DFARS reaches deep into the supply chain. If you provide parts, software, or services to a company that has a DoD contract, you are likely a subcontractor in the eyes of the regulation, and many DFARS clauses must be passed down to you.
The flow-down mechanism works like this: when a DFARS clause says it must be included in subcontracts, the prime contractor is legally required to insert it into your agreement. For commercial-item subcontracts, the default is that DFARS clauses do not automatically flow down unless a specific clause says otherwise.1eCFR. 48 CFR Part 244 – Subcontracting Policies and Procedures Several of the most important clauses do say otherwise. The cybersecurity clause (252.204-7012), the prohibited-telecommunications clause, and the Berry Amendment clause all explicitly require flow-down.
Whether a particular clause bites depends on the contract and the information you handle. The biggest trigger is whether you process, store, or transmit Controlled Unclassified Information (CUI), which DFARS calls Covered Defense Information (CDI). If you do, the cybersecurity requirements below are mandatory.
Cybersecurity Requirements
Cybersecurity is where most contractors feel the weight of DFARS. Clause 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” is the central provision. It requires every contractor and subcontractor that handles CDI to implement the security requirements in NIST Special Publication 800-171, Revision 2.2eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting That publication lays out 110 security requirements across 14 families, covering access controls, encryption, incident response, personnel screening, and more.
Meeting all 110 is the goal. The DoD recognizes that most contractors have gaps, so the regulation also requires a Plan of Actions and Milestones (POA&M) documenting which requirements you have not yet met and when you plan to close each one.
SPRS Score Submission
Before a contracting officer can award a new DoD contract, your organization must have a current self-assessment score posted in the Supplier Performance Risk System (SPRS). Under DFARS clause 252.204-7020, contractors perform a basic self-assessment against all 110 NIST SP 800-171 requirements, calculate a summary score on a scale of -203 to 110, and enter it into SPRS with the assessment date and the date they expect to reach a perfect 110.3eCFR. 48 CFR 252.204-7020 – NIST SP 800-171 DoD Assessment Requirements Every unmet requirement subtracts points, weighted by severity. No SPRS score, no contract award. Contracting officers check SPRS as part of their responsibility determination.
72-Hour Cyber Incident Reporting
If a cyber incident affects CDI or the systems that store, process, or transmit it, you must report it to the DoD within 72 hours of discovery.2eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting Reports go through the Department of Defense Cyber Crime Center (DC3) using an Incident Collection Format. Required fields include your company name, contract number, facility CAGE code, the type of compromise, a description of how the incident occurred, and the impact to covered defense information.4Department of Defense Cyber Crime Center. DIB Cybersecurity DCISE If you recover malicious software tied to the incident, you submit it through the DC3 Electronic Malware Submission portal. Seventy-two hours is a tight window, and building an incident-response plan before anything happens is not optional in practice.
CMMC 2.0 Certification
For years, DFARS cybersecurity compliance was essentially self-policed. Contractors self-assessed, posted their SPRS score, and the DoD took them at their word. The Cybersecurity Maturity Model Certification (CMMC) program adds independent verification. The CMMC final rule, codified at 32 CFR Part 170, took effect on December 16, 2024, and phased implementation in contracts began on November 10, 2025.5Department of Defense Chief Information Officer. About CMMC
CMMC has three levels. Level 1 covers the 15 basic safeguarding requirements from FAR clause 52.204-21, is self-assessed, and applies to contractors that handle Federal Contract Information (FCI) but not CUI. Level 2 maps to all 110 NIST SP 800-171 Rev 2 requirements; some contracts allow self-assessment, others require certification by an accredited third-party assessment organization (C3PAO), depending on the sensitivity of the CUI involved.6eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program Level 3 adds selected requirements from NIST SP 800-172 on top of Level 2, requires a government-led assessment, and is reserved for the most sensitive programs.p>
The DoD is rolling CMMC into solicitations on a four-phase schedule over three years. Phase 1 (November 2025 through November 2026) focuses on Level 1 and Level 2 self-assessments, though the DoD has reserved the right to require C3PAO assessments on select procurements even during Phase 1.5Department of Defense Chief Information Officer. About CMMC By Phase 4, every applicable solicitation will include the appropriate CMMC requirement.
Domestic Sourcing Rules
DFARS imposes two distinct domestic-sourcing regimes. They overlap in spirit but cover different products and apply different tests, and confusing them is a common compliance mistake.
Buy American Act Thresholds
The Buy American Act requires that manufactured end products delivered to the DoD qualify as “domestic.” Under DFARS Part 225, a product qualifies if it is manufactured in the United States and a set percentage of its component costs come from domestic or qualifying-country sources. Those thresholds are rising on a schedule: 65 percent for items delivered from 2024 through 2028, and 75 percent for items delivered starting in 2029.7Defense Federal Acquisition Regulation Supplement. 252.225-7001 Buy American and Balance of Payments Program Qualifying countries are nations with reciprocal defense procurement agreements with the United States, and their components count the same as domestic ones. Components of unknown origin are treated as foreign.
The Berry Amendment
The Berry Amendment, codified at 10 U.S.C. § 4862, goes further for a specific list of items. It bars DoD funds from being used to buy food, clothing, textiles, tents, hand or measuring tools, stainless steel flatware, dinnerware, or U.S. flags unless those items are entirely grown, reprocessed, reused, or produced in the United States.8Office of the Law Revision Counsel. 10 USC 4862 – Requirement to Buy Certain Articles from American Sources; Exceptions Unlike the Buy American Act, the Berry Amendment has no percentage test. Covered items must be 100 percent domestic. DFARS clause 252.225-7012 implements this in contracts and requires flow-down to subcontractors.9eCFR. 48 CFR 252.225-7012 – Preference for Certain Domestic Commodities Exceptions exist for items not available domestically, purchases under certain dollar thresholds, and emergency acquisitions.
Prohibited Telecommunications Equipment
Federal law prohibits contractors from providing or using certain telecommunications and video surveillance equipment or services in the performance of government contracts. Under FAR clause 52.204-25, no contractor may deliver any equipment or service that incorporates products from Huawei Technologies, ZTE Corporation, Hytera Communications, Hangzhou Hikvision, or Dahua Technology, among others.10Acquisition.GOV. 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment The ban extends to subsidiaries and affiliates.
DFARS adds a parallel clause, 252.204-7018, covering “covered defense telecommunications equipment or services.” If a contractor discovers prohibited equipment in its supply chain during contract performance, it must report through the DIBNet portal within three business days and submit a follow-up report within 30 business days describing mitigation actions.11GovInfo. 48 CFR 252.204-7018 – Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services Both clauses require flow-down, so every company in the supply chain shares the obligation to screen for and exclude these products.
The FCC maintains a publicly available Covered List of banned equipment and services that is updated periodically. As of its most recent update in March 2026, it includes the manufacturers named above plus Kaspersky Lab cybersecurity products, several Chinese telecommunications carriers, and certain foreign-made uncrewed aircraft systems.12Federal Communications Commission. List of Equipment and Services Covered By Section 2 of The Secure Networks Act
Quality Assurance
DFARS Part 246 establishes quality assurance requirements for defense contracts. Contractors must maintain quality management systems that ensure products and services meet the specifications in their contracts.13eCFR. 48 CFR Part 246 – Quality Assurance In practice, that means documenting inspection and testing procedures, managing nonconforming items before delivery, and cooperating with government audits. Specific quality standards, such as AS9100 for aerospace, are imposed contract by contract depending on what you produce.
What Non-Compliance Costs
The penalties for failing to meet DFARS are not theoretical. Contracting officers can terminate a contract for default, leaving the contractor liable for excess reprocurement costs. False statements about compliance, such as posting an inflated SPRS score or misrepresenting domestic content, can trigger liability under the False Claims Act, which carries penalties of over $27,000 per false claim plus treble damages.
Beyond individual contracts, the government can suspend or debar a non-compliant contractor. Debarment bars a company from receiving any new federal contracts across the entire executive branch, not just from the DoD, and typically lasts three years.14Acquisition.GOV. FAR Subpart 9.4 – Debarment, Suspension, and Ineligibility Even a proposed debarment, before any final decision, excludes the contractor from new awards. The reputational damage alone can cost commercial business, because private-sector customers in the defense supply chain often avoid working with debarred or suspended firms.
With CMMC now rolling into solicitations, the stakes are higher than they were even two years ago. A contractor that cannot demonstrate the required CMMC level is simply ineligible for award, regardless of price or past performance.