FAR and DFARS Requirements for Contractors

The FAR is the government-wide rulebook for federal acquisition, and the DFARS is the Department of Defense’s supplement to it. For a research institution, the practical question is not which book is bigger but which clause in your contract is triggered by the information you will handle. This guide separates the two layers and ties each requirement to the clause text, as described on eCFR on 2026-10-29.

How the FAR and DFARS fit together

FAR 1.101 states that the Federal Acquisition Regulations System is established for the codification and publication of uniform policies and procedures for acquisition by all executive agencies. The same section says the system includes agency acquisition regulations that implement or supplement the FAR. The DFARS is the Defense Federal Acquisition Regulation Supplement, which is how the Department of Defense adds its own requirements on top of the government-wide text.

So the answer to “does DFARS replace the FAR?” is no: the DFARS sits alongside the FAR and adds defense-specific clauses. A contract from a civilian agency draws on the FAR and that agency’s own supplement; a Department of Defense contract draws on the FAR and the DFARS. To read an individual clause in a solicitation, see how to read a FAR clause.

FAR requirements that apply to most contracts

The clause most often met by universities handling contract information is FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (NOV 2021). It protects federal contract information (FCI), defined in the clause as information, not intended for public release, that is provided by or generated for the Government under a contract. Publicly released information and simple transactional information, such as that needed to process payments, are excluded.

The clause lists 15 basic safeguarding requirements in paragraph (b)(1). The first three are to limit information system access to authorized users, processes acting for authorized users, or devices; to limit access to the types of transactions and functions that authorized users are permitted to execute; and to verify and control connections to external systems. Paragraph (c) requires the contractor to flow down the substance of the clause to subcontracts where the subcontractor may have FCI, including subcontracts for commercial products or services other than commercially available off-the-shelf items.

For other FAR clauses commonly attached to institutional contracts, such as the representation and compliance clauses, see federal contract compliance.

What the DFARS adds

DFARS 252.204-7012: covered defense information and cyber incidents

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (MAY 2024), goes further than the FAR clause. Contractor information systems that are not operated on behalf of the Government must be subject to the security requirements of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer. The clause sets an implementation date of December 31, 2017, and allows the contractor to request a variance from a NIST SP 800-171 requirement in writing to the Contracting Officer.

The clause also requires cyber incidents to be reported rapidly, defined as within 72 hours of discovery, and the report goes to DoD through dibnet.dod.mil (paragraph (c)(1)(ii)). For how a university applies the NIST SP 800-171 controls in practice, see NIST SP 800-171 and CUI in university research.

DFARS Subpart 204.75: CMMC status at award

DFARS 204.7502 sets the Cybersecurity Maturity Model Certification (CMMC) policy for contracting officers. The Contracting Officer includes the required CMMC level in the solicitation when the program office provides one, and does not award to an offeror that lacks current CMMC status at that level. The contractor must hold the status at award and maintain it for the life of the contract for systems that process, store or transmit FCI or CUI. Level 2 and Level 3 status may be conditional for no more than 180 days from the CMMC status date; Level 1 requires a final level for award. See the CMMC Level 2 assessment guide for the assessment itself.

Which requirement applies to your data

Information in the contract	Clause or rule	What it requires
No federal contract information	No safeguarding clause triggered by this row	Nothing under 52.204-21 or 252.204-7012 for this information
Federal contract information (FCI)	FAR 52.204-21	15 basic safeguarding requirements in paragraph (b)(1)
Covered defense information	DFARS 252.204-7012	NIST SP 800-171 security requirements, 72-hour cyber incident reporting
FCI or CUI on systems named in the solicitation’s CMMC requirement	DFARS 204.7502	Current CMMC status at the required level at award and for the life of the contract

The categories overlap: a contract can carry FCI and covered defense information at once, and more than one clause then applies. The difference between the two data types is covered in FCI vs CUI.

How flow-down differs between the two clauses

Both clauses reach subawards, but the wording differs. FAR 52.204-21(c) requires the substance of the clause in subcontracts where the subcontractor may have FCI, and it expressly includes commercial products and services other than COTS items. DFARS 252.204-7012(m) requires the clause itself, without alteration except to identify the parties, in subcontracts for operationally critical support or those involving covered defense information. A prime contractor that is a university should therefore check which of the two tests each subaward meets before copying clause text into it.

Steps to check a solicitation

List the FAR and DFARS clauses in the solicitation and read each clause’s own date and text, since clauses are revised.
Identify what information the project will receive or generate: FCI, covered defense information, or neither.
Check whether the solicitation states a CMMC level under DFARS 204.7502.
Check which NIST SP 800-171 requirements and which version the Contracting Officer has specified for the contract.
Decide, for each subaward, whether the FAR substance flow-down or the DFARS flow-down without alteration applies.
Ask the Contracting Officer in writing about any requirement you cannot meet, since 252.204-7012 provides for written variance requests.

Common mistakes

Treating the DFARS as a replacement for the FAR instead of an addition to it.
Assuming a grant and a contract carry the same clauses; see federal contracts vs grants for university research.
Reading only the clause title and missing a flow-down requirement in the subaward.
Waiting until award to ask about CMMC status when the solicitation already states a required level.
Counting 72 hours from the end of an investigation instead of from discovery of the incident.

Page	What it covers
FAR clause	How to read a clause in a solicitation or contract
DFARS 252.204-7021	The DFARS clause on CMMC requirements
SPRS score	NIST SP 800-171 self-assessment score reporting
FCI vs CUI	How the two information categories differ

FAQ

Does DFARS replace the FAR?

No. FAR 1.101 describes the FAR system as including agency regulations that implement or supplement the FAR, and the DFARS is the Department of Defense’s supplement. Both can apply to the same defense contract.

What is the difference between FAR 52.204-21 and DFARS 252.204-7012?

FAR 52.204-21 sets 15 basic safeguarding requirements for federal contract information. DFARS 252.204-7012 applies to covered defense information, requires NIST SP 800-171 security requirements and requires reporting cyber incidents within 72 hours of discovery.