Defense Federal Acquisition Regulation Supplement
The Department of Defense's supplement to US federal acquisition rules, which includes the cybersecurity clauses that bind defense contractors. Clause 252.204-7012 requires contractors handling covered defense information to implement NIST SP 800-171 and report cyber incidents to the DoD. DFARS requirements are the contractual foundation that CMMC certification is designed to verify.