DFARS 252.204-7012, explained

Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is the contract clause that tells a Department of Defense (DoD) contractor how to protect unclassified but controlled government information on its own systems and what to do when those systems are attacked. The version on Acquisition.gov is dated May 2024, and a Revolutionary FAR Overhaul class deviation issued a JUN 2026 version, covered below. The clause has four working parts: a definition of the information it covers, a requirement for adequate security built on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, a 72-hour cyber incident reporting duty, and a flow-down to subcontractors. Three later clauses, 252.204-7019, 252.204-7020, and 252.204-7021, add verification on top of it, and the same deviation replaces 7019 and 7020 with 252.240-7997. Searchers call it "DFARS 7012."

Where the clause comes from and where it goes

The policy behind the clause sits in DFARS subpart 204.73. Section 204.7302 states that contractors must provide adequate security on covered contractor information systems and rapidly report cyber incidents to DoD at dibnet.dod.mil. The same section says a cyber incident that is properly reported is not, by itself, evidence that the contractor failed to provide adequate security or comply with the clause.

Section 204.7304 prescribes each clause and provision in the family. Provision 252.204-7008 goes in all solicitations, clause 252.204-7012 goes in all solicitations and contracts, provision 252.204-7019 goes in all solicitations, and clause 252.204-7020 goes in all solicitations, contracts, task orders, and delivery orders. Every one of those includes acquisitions under Federal Acquisition Regulation (FAR) Part 12 commercial procedures, and every one excludes solicitations and contracts solely for commercially available off-the-shelf (COTS) items. Clause 252.204-7009 is prescribed separately for services that support the Government's own safeguarding and incident reporting activities.

The DoD procedures, guidance, and information (PGI) at PGI 204.73 tell the contracting officer what to do before award and after an incident. Before award, the requiring activity flags a contract that will involve covered defense information or operationally critical support, and the contracting officer makes sure the statement of work identifies that information and requires the contractor to mark it. The Defense Pricing, Contracting, and Acquisition Policy safeguarding page collects the memos issued around the clause since 2018, including a June 16, 2022 memo on contractual remedies when a contractor does not comply.

The 2026 class deviations

The same office's Revolutionary FAR Overhaul class deviations page posts one deviation per DFARS part, each used in lieu of the codified text in 48 CFR chapter 2. Class deviation 2026-O0043 marked subparts 204.73 and 204.75 Reserved, effective February 17, 2026. The material moved to DFARS subpart 240.3 in class deviation 2026-O0025, whose Revision 3 is dated September 3, 2026. Section 240.370-3 carries the policy of 204.7302, section 240.370-5 prescribes 7008, 7009, and 7012 with the same commercial and COTS scope and prescribes 252.240-7997 in place of 7019 and 7020, and the PGI steps move to PGI 240.370-4. The sections below cite the codified numbers.

Covered defense information

The clause protects covered defense information (CDI), not every piece of data a contractor touches. Paragraph (a) defines it as unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy, and that is either marked or otherwise identified in the contract and provided to the contractor by or on behalf of DoD, or collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the contract.

Controlled technical information is the most common kind. The clause defines it as technical information with military or space application that is subject to controls on access, use, reproduction, modification, performance, display, release, disclosure, or dissemination, and it borrows the definition of technical information from DFARS 252.227-7013: research and engineering data, drawings, specifications, standards, process sheets, manuals, technical reports, data sets, and computer software. The JUN 2026 deviation text cites 252.227-7989 instead, which class deviation 2026-O0036 prescribes in place of 7013 from February 1, 2026. The CUI Registry entry lists controlled technical information as a CUI Specified category with the marking CTI, cites 48 CFR 252.204-7012 as its safeguarding authority, and requires distribution statements B through F under DoD Instruction 5230.24. Information that is lawfully and publicly available without restriction is excluded.

The clause has a second trigger that has nothing to do with the information itself. Operationally critical support is supplies or services the Government designates as critical for airlift, sealift, intermodal transportation, or logistical support essential to mobilizing, deploying, or sustaining the armed forces in a contingency operation. A contractor providing it must report cyber incidents that affect its ability to perform, whether or not CDI is involved.

A covered contractor information system is any unclassified system owned or operated by or for the contractor that processes, stores, or transmits CDI. The clause requires adequate security on the systems that hold the information, not on every system in the company, so where a company draws that boundary is the largest decision in complying.

Adequate security and NIST SP 800-171

Paragraph (b) requires the contractor to provide adequate security on all covered contractor information systems. Adequate security means protective measures commensurate with the consequences and probability of loss, misuse, or unauthorized access to or modification of information. The paragraph then splits into two cases.

Under (b)(1), systems that are part of an information technology service or system operated on behalf of the Government follow the Government's rules: cloud computing services follow DFARS 252.239-7010 and the DoD Cloud Computing Security Requirements Guide, and other systems follow whatever security requirements the contract specifies.

Under (b)(2), every other covered contractor information system must, at a minimum, implement NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, "in effect at the time the solicitation is issued or as authorized by the Contracting Officer." The JUN 2026 deviation text adds Revision 2. The clause set a deadline of December 31, 2017 for implementation. A contractor that wants to vary from a requirement sends a written explanation to the contracting officer for the DoD Chief Information Officer (CIO) to adjudicate, showing either that the requirement does not apply or that an alternative but equally effective measure is in place. Provision 252.204-7008 has the offeror represent, by submitting an offer, that it will implement the requirements, and routes variance requests through the same channel before award. PGI 204.7303-2 gives the DoD CIO mailbox the contracting officer uses.

Which revision applies

The phrase "in effect at the time the solicitation is issued" raises the obvious question of which revision that is. NIST's publication page for SP 800-171 Revision 2 says it was withdrawn on May 14, 2024 and superseded by Revision 3, published May 2024, with a companion assessment guide, SP 800-171A Revision 3, published the same month. DoD's own verification machinery, however, still runs on Revision 2. The Cybersecurity Maturity Model Certification (CMMC) rule at 32 CFR Part 170 incorporates NIST SP 800-171 R2 by reference, and the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 of June 24, 2020, scores a contractor against the 110 requirements of SP 800-171, the same count in Revisions 1 and 2. In the October 15, 2024 CMMC final rule, DoD acknowledged the difference between the clause's language and the rule, said it cites Revision 2 to give industry and the assessment ecosystem time to prepare, and said it will issue future amendments to incorporate the current version at that time. The deviation settles it for contracts that use it: its clause names Revision 2, and Revision 3 of class deviation 2026-O0025 cites a July 13, 2026 DoW CIO memo requiring baseline compliance with NIST SP 800-171 Rev 2 under 7012. A contractor reading a solicitation today should still check which clause version and revision the solicitation or contracting officer names rather than assume.

What the methodology adds

The methodology does not add requirements; its purpose statement says it is for assessment only. The contractor must have a system security plan (requirement 3.12.4) describing each covered system and a plan of action (requirement 3.12.2) for each unimplemented requirement. Without a system security plan, the methodology says an assessment cannot be completed and the result is a finding of noncompliance with the clause. The scoring starts at 110 and subtracts 5, 3, or 1 points for each requirement not implemented, which may produce a negative score, and a plan of action does not earn the points back.

Cloud providers and FedRAMP Moderate equivalency

Paragraph (b)(2)(ii)(D) covers the case where the contractor uses an external cloud service provider (CSP) to store, process, or transmit CDI. The CSP must meet security requirements equivalent to those the Government established for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline, and the contractor must require the CSP to comply with paragraphs (c) through (g) of the clause, meaning cyber incident reporting, malicious software submission, media preservation, access for forensic analysis, and damage assessment support.

The clause does not define equivalent. The 2024 CMMC final rule's comment discussion names the DoD CIO's December 21, 2023 memorandum, Federal Risk and Authorization Management Program Moderate Equivalency for Cloud Service Provider's Cloud Service Offerings, as the separate DoD policy memo that defines what a CSP must meet. The memo is posted on the DoD CIO Library page under the title Memo: FEDRAMP Equivalency for Cloud Service Providers. The rule's response also lays out the practical split. A contractor using a FedRAMP Authorized cloud offering at the Moderate baseline or higher is not responsible for the CSP's compliance, but must document in its own system security plan how it meets the requirements assigned to it in the CSP's customer responsibility matrix. A contractor using a CSP that is not FedRAMP Authorized is responsible for determining whether the CSP meets FedRAMP Moderate equivalency as specified in DoD policy, and must document the same customer responsibilities. Section 170.16(c)(2) of 32 CFR Part 170 carries the requirement into CMMC Level 2 self-assessments as FedRAMP Moderate or FedRAMP Moderate equivalent in accordance with DoD policy, and the rule states that CMMC adds no new CSP requirements beyond those in 252.204-7012.

Two limits apply. The requirement covers only cloud services that hold CDI; the 2024 rule says a cloud offering that does not process, store, or transmit CUI does not need FedRAMP. And the clause binds the contractor, who must in turn bind its provider by contract.

Cyber incident reporting within 72 hours

Paragraph (c) is the part of the clause most searched for. A cyber incident is an action taken through computer networks that results in a compromise or an actual or potentially adverse effect on an information system or the information on it. When the contractor discovers one that affects a covered contractor information system, the CDI on it, or its ability to perform operationally critical support, it must do two things. First, review for evidence of compromise, identifying compromised computers, servers, specific data, and user accounts, and analyze other systems on its network that may have been accessed. Second, rapidly report the incident to DoD at dibnet.dod.mil. The clause defines rapidly report as "within 72 hours of discovery of any cyber incident."

The report must include the elements DIBNet requires, and it is treated as information created by or for DoD. Paragraph (c)(3) requires the contractor or subcontractor to have or acquire a DoD-approved medium assurance certificate to submit it. As of October 25, 2026, dibnet.dod.mil redirects to the DIB Cybersecurity DCISE page at the DoD Cyber Crime Center (DC3). That page describes the DoD-Defense Industrial Base Collaborative Information Sharing Environment (DCISE) as the single focal point for DIB cyber incident reporting required by 10 U.S.C. 391 and 393 and DFARS 252.204-7012, says a Department of War-approved medium assurance certificate is required to reach the secure reporting portal, names IdenTrust and WidePoint as approved External Certification Authority vendors, and gives a hotline at 410-981-0104 and 1-877-838-2174 for companies that do not yet have a certificate. The page separates mandatory reporting under the clause from voluntary reporting under the DIB Cybersecurity Program.

The regulation behind the portal is 32 CFR Part 236, DoD Defense Industrial Base Cybersecurity Activities. As amended in March 2024, Section 236.4(e) also says a contractor shall have a PIEE account to access the DIBNet portal, in addition to the medium-assurance certificate the clause requires. Section 236.2 defines rapid reporting as within 72 hours of discovery, and Section 236.4 requires rapid reporting, requires the reporting requirement to appear in all relevant agreements including contracts, grants, and other transaction agreements, allows a third-party service provider to report on a contractor's behalf, and requires subcontractors to report directly to DoD and to give the prime the DoD-assigned incident report number. Section 236.5 describes the voluntary DIB CS Program, in which eligible contractors sign a framework agreement to share threat information with DC3.

After the report, PGI 204.7303-3 says DC3 sends it by encrypted email to the contracting officers listed on the incident collection format, and the procuring contracting officer notifies the requiring activities with affected contracts. If the requiring activity asks for a compliance assessment, the contracting officer consults the component CIO or cybersecurity office and asks the contractor to describe its NIST SP 800-171 implementation; DFARS 204.7302(d), and 240.370-3(d) under the deviation, say the incident is then considered as part of that overall assessment.

Malicious software, media, and damage assessment

Paragraphs (d) through (g) govern what happens after the report. Under (d), malicious software the contractor discovers and isolates in connection with a reported incident goes to DC3 in accordance with instructions from DC3 or the contracting officer, and never to the contracting officer directly. PGI 204.7303-3 repeats that rule and provides the Instructions for Malware Submission document on request.

Under (e), the contractor must preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data for at least 90 days from submission of the report, to allow DoD to request the media or decline interest. Under (f), DoD may request access to additional information or equipment for forensic analysis. Under (g), if DoD elects to conduct a damage assessment, the contracting officer requests the information gathered under paragraph (e). PGI 204.7303-4 adds the mechanics: the contracting officer verifies that the contract actually contains 252.204-7012 before a damage assessment begins, sends a written request with the Instructions for Media Submission and copies DC3, and documents the action in the contract file; DC3 confirms receipt of media in writing, and the requiring activity gives the contracting officer a close-out report when the assessment is complete.

Paragraphs (h) through (l) protect the contractor. DoD must protect contractor attributional and proprietary information in the report against unauthorized use or release, and the contractor shall, to the maximum extent practicable, identify and mark it. Information not created by or for DoD may be released outside DoD only to entities whose missions may be affected, entities helping to diagnose or mitigate the incident, counterintelligence or law enforcement, national security purposes including sharing with DIB participants in the program at 32 CFR Part 236, and support services contractors bound by clause 252.204-7009, which limits those contractors to advising or assisting the Government and requires nondisclosure agreements from their employees. The clause does not relieve the contractor of any other safeguarding or reporting obligation under the contract or other law.

Flow-down to subcontractors

Paragraph (m) requires the contractor to include the clause, including paragraph (m) itself, without alteration except to identify the parties, in subcontracts or similar instruments for operationally critical support or for which subcontract performance will involve CDI. That includes subcontracts for commercial products or commercial services. The clause text itself states no COTS exception for subcontracts. The prime decides whether information it passes down still qualifies as CDI, consulting the contracting officer if necessary.

The subcontractor has two duties back up the chain. It must notify the prime or next higher tier when it requests a variance from a NIST SP 800-171 requirement, and it must give the prime the DoD-assigned incident report number as soon as practicable after reporting an incident. Section 204.7302 describes the same chain: the subcontractor reports directly to DoD and passes the report number up until it reaches the prime.

How 7019, 7020 and 7021 build on it

Clause 252.204-7012 relies on the contractor's own word. The September 29, 2020 interim rule that created 252.204-7019 and 252.204-7020 explained that offerors self-attest to implementing NIST SP 800-171 and that neither the FAR nor the DFARS clause provided for DoD verification before award. The three later clauses supply that verification.

The relationship runs one way. Clause 7020 applies to covered contractor information systems that must comply with NIST SP 800-171 under 7012, so it presupposes 7012. Clause 7021 defines CMMC status as the result of meeting the minimum score for the corresponding assessment, and 32 CFR Part 170 assesses the same NIST SP 800-171 Revision 2 requirements. None of the three changes the text of 7012, and a cyber incident is still reported under paragraph (c) of 7012 regardless of CMMC status. Section 204.7302 says a DoD assessment under 7020 should not duplicate a CMMC assessment except in rare cases, as does section 240.370-3(a)(4) of the deviation. The May 2026 SPRS user guide ties its NIST SP 800-171 tab to 252.240-7997, previously 7019 and 7020, and still lets vendors enter Basic self-assessments.

What to check

• Does the statement of work identify the covered defense information, and does the contract tell the contractor how to mark it, as PGI 204.7303-1 (PGI 240.370-4 under the deviation) requires?
• Does the solicitation use the codified clauses or the class deviation 2026-O0025 versions, with 7012 dated JUN 2026 and 252.240-7997 in place of 7019 and 7020?
• Which revision of NIST SP 800-171 does the solicitation or contracting officer name, and does the system security plan say so?
• For every cloud service that holds CDI, is the offering FedRAMP Authorized at Moderate or higher, or has the contractor documented how it meets FedRAMP Moderate equivalency under DoD policy, with the customer responsibility matrix reflected in the system security plan?
• Does the company hold a DoD-approved medium assurance certificate today, before an incident, and does the incident response plan name DIBNet and the 72-hour clock?
• Do subcontracts that will involve CDI carry the clause with paragraph (m), and do they exclude only COTS items?
• Is the 90-day media preservation step written into the incident procedure, with images and packet captures held from the date the report is submitted?

Azcuna's LEDGER turns a trade study into a Decision Package in which every number cites its source and AI agents draft but never decide. It was proposed to the Army under SBIR Phase I topic ARM26BX06-NV012, and the proposal was submitted on October 21, 2026.

Questions people ask

What is DFARS 7012?

DFARS 7012 is shorthand for Defense Federal Acquisition Regulation Supplement clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The codified clause on Acquisition.gov is dated May 2024, and class deviation 2026-O0025 issues a JUN 2026 version that names NIST SP 800-171 Revision 2. Both require adequate security on information systems that hold covered defense information, NIST SP 800-171 at a minimum, cyber incident reports to DoD within 72 hours, and flow-down to subcontractors that handle the information.

What is the 72 hour cyber incident reporting requirement for DoD contractors?

DFARS 252.204-7012 defines rapidly report as within 72 hours of discovery of any cyber incident. When a contractor discovers an incident that affects a covered contractor information system, the covered defense information on it, or its ability to perform operationally critical support, it must review for evidence of compromise and submit a report to DoD at dibnet.dod.mil within that window. The report must contain the elements DIBNet asks for, and 32 CFR 236.2 and 236.4 state the same rule.

What is covered defense information?

DFARS 252.204-7012 defines covered defense information as unclassified controlled technical information or other information listed in the CUI Registry that requires safeguarding or dissemination controls under law, regulation, or policy, and that is either marked or otherwise identified in the contract and provided by or for DoD, or collected, developed, received, transmitted, used, or stored by or for the contractor in performing the contract. The CUI Registry lists controlled technical information as a CUI Specified category marked CTI.

What does FedRAMP Moderate equivalent mean under DFARS 7012?

Paragraph (b)(2)(ii)(D) of DFARS 252.204-7012 says that when a contractor uses an external cloud service provider to store, process, or transmit covered defense information, the provider must meet security requirements equivalent to those the Government set for the FedRAMP Moderate baseline and must comply with the clause's incident reporting, malware, media, and damage assessment paragraphs. The October 15, 2024 CMMC final rule's comment discussion names the DoD CIO's December 21, 2023 memorandum on FedRAMP Moderate Equivalency, and DoD's response points to that policy memo for what equivalency requires.

Which version of NIST SP 800-171 does DFARS 7012 require?

The codified May 2024 clause requires the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer. The JUN 2026 deviation text under class deviation 2026-O0025 names Revision 2, and the September 3, 2026 revision of that deviation cites a July 13, 2026 DoW CIO memo requiring baseline Revision 2 compliance under 7012. NIST withdrew Revision 2 on May 14, 2024 in favor of Revision 3, and the CMMC rule at 32 CFR Part 170 also specifies Revision 2.

Does DFARS 7012 require a CMMC certification?

No. DFARS 252.204-7012 requires adequate security, NIST SP 800-171 implementation, and incident reporting, and the contractor attests to that by accepting the contract. CMMC is a separate requirement carried by DFARS 252.204-7021 and 32 CFR Part 170, which verify the same NIST SP 800-171 requirements through a self-assessment or third-party assessment. Under a July 13, 2026 DoW CIO memo cited in class deviation 2026-O0025, requiring activities may include only Level 1 (Self) or Level 2 (Self). The clauses can appear together, and 7021 does not change 7012.

Does DFARS 7012 apply to commercial items and COTS?

Codified DFARS 204.7304, and DFARS 240.370-5(c) under class deviation 2026-O0025, prescribe clause 252.204-7012 for all solicitations and contracts, including those using FAR Part 12 procedures for commercial products and services, except those solely for commercially available off-the-shelf items. Class deviation 2026-O0043 reserved subpart 204.73 effective February 17, 2026. The flow-down paragraph (m) covers subcontracts for commercial products or commercial services, and the clause carries no separate COTS carve-out for subcontracts.

What is a medium assurance certificate and why do I need one to report?

DFARS 252.204-7012 paragraph (c)(3) says a contractor or subcontractor must have or acquire a DoD-approved medium assurance certificate to report cyber incidents. The DC3 DCISE page, which dibnet.dod.mil redirects to as of October 25, 2026, says the certificate is required to reach the secure reporting portal and names IdenTrust and WidePoint as approved External Certification Authority vendors. A company without a certificate can call the DCISE hotline for reporting assistance.

How long must a contractor preserve media after a cyber incident?

Paragraph (e) of DFARS 252.204-7012 requires the contractor to preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data for at least 90 days from submission of the cyber incident report. The 90 days gives DoD time to request the media or decline interest. If DoD requests media or a damage assessment, PGI 204.7303-4, which is PGI 240.370-4 under class deviation 2026-O0025, has the Contracting Officer send a written request with the Instructions for Media Submission.

What is the difference between DFARS 7012 and 7020?

DFARS 252.204-7012 sets the security and reporting obligations. In the codified DFARS, provision 252.204-7019 and clause 252.204-7020, dated November 2023, require a current Basic, Medium, or High assessment under the DoD Assessment Methodology with the score in the Supplier Performance Risk System, and 7020 requires a prime to confirm a subcontractor's assessment first. Class deviation 2026-O0025 replaces both with clause 252.240-7997, dated FEB 2026, which covers only Medium and High assessments by Government personnel.

Sources

1. 1252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting · Acquisition.gov
2. 2Subpart 204.73 - Safeguarding Covered Defense Information and Cyber Incident Reporting · Acquisition.gov
3. 3PGI 204.73 - Safeguarding Covered Defense Information and Cyber Incident Reporting · Acquisition.gov
4. 4252.204-7008 Compliance with Safeguarding Covered Defense Information Controls · Acquisition.gov
5. 5252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information · Acquisition.gov
6. 6252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements · Acquisition.gov
7. 7252.204-7020 NIST SP 800-171 DoD Assessment Requirements · Acquisition.gov
8. 8252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements · Acquisition.gov
9. 9252.239-7010 Cloud Computing Services · Acquisition.gov
10. 10DIB Cybersecurity DCISE · Department of Defense Cyber Crime Center
11. 1132 CFR Part 236 - Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) Activities (July 1, 2025 edition) · U.S. Government Publishing Office
12. 12CUI Registry - Controlled Technical Information · National Archives and Records Administration
13. 13NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020 · Office of the Under Secretary of Defense for Acquisition and Sustainment
14. 14Policy - Safeguarding Covered Defense Information and Cyber Incident Reporting · Defense Pricing, Contracting, and Acquisition Policy
15. 15Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 2) · National Institute of Standards and Technology
16. 16Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 3) · National Institute of Standards and Technology
17. 17Assessing Security Requirements for Controlled Unclassified Information (NIST SP 800-171A Rev. 3) · National Institute of Standards and Technology
18. 1832 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program (July 1, 2025 edition) · U.S. Government Publishing Office
19. 19Cybersecurity Maturity Model Certification (CMMC) Program; Final Rule, 89 FR 83092 (October 15, 2024) · Federal Register, U.S. Government Publishing Office
20. 20Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041); Interim Rule, 85 FR 61505 (September 29, 2020) · Federal Register, U.S. Government Publishing Office
21. 21CIO - Library · Department of Defense Chief Information Officer
22. 22DFARS Revolutionary FAR Overhaul Class Deviations · Defense Pricing, Contracting, and Acquisition Policy
23. 23Class Deviation 2026-O0025, Revision 3 - Revolutionary FAR Overhaul Part 40, DFARS Part 240 (September 3, 2026) · Defense Pricing, Contracting, and Acquisition Policy
24. 24Class Deviation 2026-O0043 - Revolutionary FAR Overhaul Part 4, DFARS Part 204 (February 3, 2026) · Defense Pricing, Contracting, and Acquisition Policy
25. 25Class Deviation 2026-O0036 - Revolutionary FAR Overhaul Part 27, DFARS Part 227 (January 21, 2026) · Defense Pricing, Contracting, and Acquisition Policy
26. 26SPRS Software User's Guide for Awardees/Contractors, Version 4.1.5 (May 2026) · Supplier Performance Risk System, Naval Sea Logistics Center

Where this shows up in our work

• LEDGER, auditable Army acquisition decisions turns a trade study into a package where every number cites its source and AI drafts but never decides.
• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.