What Is DFARS and Who Does It Apply To?
DFARS is the Department of Defense’s supplement to the Federal Acquisition Regulation, or FAR. It contains rules and contract clauses for buying goods and services for the U.S. Department of Defense. DFARS can affect prime contractors, subcontractors, suppliers, and other businesses—but its requirements do not apply to every company automatically. The contract, the specific clauses it includes, and the work being performed determine which rules apply.
What Does DFARS Stand For?
DFARS stands for the Defense Federal Acquisition Regulation Supplement. The FAR sets government-wide acquisition rules; DFARS adds provisions and clauses tailored to Department of Defense purchases. The Department of Defense (DoD) uses it when acquiring products, services, construction, and research and development.
DFARS is part of the federal acquisition system, not a standalone certification. It is maintained in the official DFARS online text and is organized into parts covering subjects such as competition, contract types, pricing, intellectual property, and cybersecurity.
A DFARS provision or clause may describe what a company must disclose when submitting an offer, what it must do during contract performance, or what records it must retain. Some clauses are included only when particular conditions apply; others are prescribed for broader categories of DoD contracts. The contracting officer and contract documents establish the applicable requirements.
Who Does DFARS Apply To?
DFARS applies to DoD contracting actions and to businesses to the extent that relevant requirements are included in, or flow down from, their contracts. It may affect:
- Prime contractors that hold contracts directly with the DoD.
- Subcontractors performing work under a DoD prime contract, when required clauses are flowed down.
- Suppliers and manufacturers providing parts, materials, software, or other items for a covered contract.
- Service providers handling covered information or performing services for a DoD contractor.
- Other entities, such as certain research organizations or commercial vendors, when contract terms and applicable rules impose requirements on them.
A company does not become subject to every DFARS rule simply because it sells to the federal government, registers in SAM.gov, or has a defense customer. The relevant contract language matters. A firm that holds no DoD contract and performs no work subject to a DoD subcontract may have no DFARS obligations from that relationship.
Subcontractors should not assume that requirements stop at the prime contractor. Some DFARS clauses direct the prime to include specified terms in subcontracts, sometimes only for subcontracts involving particular supplies, services, or information. The prime contractor generally communicates those terms, but each business should review its own subcontract and ask for clarification when clause applicability is unclear.
How DFARS Requirements Reach a Business
DFARS clauses are incorporated into solicitations and contracts. A solicitation may include provisions that bidders must address before award, while an awarded contract contains clauses governing performance. The contract may also incorporate FAR clauses and other agency-specific terms, so a DFARS review should not be limited to searching for the letters “DFARS.”
Applicability can depend on several factors: the type of acquisition, the product or service, the contract’s dollar value, whether commercial-item rules apply, the information involved, and the clause’s own language. A clause may also specify whether and how it must be included in subcontracts.
For that reason, a useful first step is to identify every clause in the solicitation, prime contract, or subcontract that applies to the work. Contracting officers can answer questions about the government’s solicitation or contract; prime contractors can explain flow-down terms in their subcontracts. Legal or acquisition professionals may help interpret complex or conflicting requirements.
Common DFARS Requirements
DFARS covers many acquisition topics. The following examples are particularly relevant to businesses working with defense contracts. They are not a complete list, and the exact obligation depends on the clause and contract circumstances.
Cybersecurity and Controlled Information
Several widely discussed clauses address information security. DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” sets requirements for safeguarding covered defense information on contractor information systems and reporting certain cyber incidents. It can require contractors to follow specified security standards, preserve relevant data and equipment, and provide information to the government after an incident.
The clause refers to covered defense information, a defined category that includes certain controlled technical information or other information requiring safeguarding or dissemination controls. It also addresses covered contractor information systems. Not every piece of data received from a defense customer necessarily meets the definition, so businesses must determine what information is involved and where it is stored or processed.
For covered systems, the clause generally points to the security requirements in NIST Special Publication 800-171, subject to the clause’s terms and applicable exceptions. The current contract language and the version of the standard specified by the applicable rules should be checked rather than relying on an old checklist or a vendor’s general claim of compliance.
Other relevant clauses include DFARS 252.204-7019 and 252.204-7020, which address NIST SP 800-171 assessments and related access or verification provisions. Where applicable, assessment requirements and results may affect a contractor’s eligibility for award. Businesses should confirm the required assessment type, timing, scope, and system boundary under their contract.
DFARS 252.204-7021 addresses the Cybersecurity Maturity Model Certification (CMMC) program. CMMC requirements are being implemented through DoD regulations and acquisition rules. Businesses should check current DoD guidance, the solicitation, and the contract to determine whether a particular CMMC level or assessment is required. A future or proposed requirement should not be treated as an obligation in a contract unless the applicable rule and contract make it so.
Cyber Incident Reporting
When DFARS 252.204-7012 applies, a contractor that discovers a cyber incident affecting a covered system or covered defense information may have to report it to the DoD within the timeframe specified in the clause—generally within 72 hours of discovery. The clause also includes requirements related to preserving images of affected systems and relevant monitoring data. The incident-response process should therefore identify who can assess an event, make a report, and preserve evidence promptly.
Domestic Sources and Specialty Metals
Some DFARS clauses restrict or condition the use of certain foreign products or materials. Examples include the Berry Amendment, which applies to specified categories of items acquired by the DoD, and specialty-metals restrictions. The rules have defined product categories, exceptions, and thresholds; they are not blanket requirements that every item in every defense contract must be manufactured in the United States.
Businesses sourcing clothing, food, fabrics, metals, or other potentially covered products should review the relevant clause and trace the origin of materials through their supply chain. A supplier’s country-of-origin statement may be useful, but it should match the clause’s definitions and the product’s actual manufacturing history.
Pricing, Cost Accounting, and Records
Depending on contract type and circumstances, DFARS and associated FAR clauses may require cost or pricing data, cost accounting practices, audits, or supporting records. The rules differ for fixed-price, cost-reimbursement, commercial, and other acquisition arrangements. Contract value alone does not answer every question; exemptions and clause-specific conditions may apply.
Contractors should maintain records that support invoices, cost claims, pricing representations, and required certifications. A company should not assume that an accounting system suitable for commercial business automatically meets every contract requirement.
Technical Data and Intellectual Property
DFARS provisions govern rights in technical data and computer software developed or delivered under DoD contracts. These clauses can affect the government’s rights to use, reproduce, release, or disclose technical information. The outcome may depend on whether development was funded privately, with government funds, or through a combination, as well as on the markings and contract terms.
Before delivering technical data or software, contractors should identify pre-existing materials, document development funding where relevant, and apply appropriate markings under the contract. Mistakes can create disputes over rights that are difficult to resolve after delivery.
DFARS and FAR: What Is the Difference?
| Feature | FAR | DFARS |
|---|---|---|
| Scope | Government-wide acquisition rules | DoD-specific supplement to the FAR |
| Use | Applies across federal agencies, subject to its terms | Applies to DoD acquisitions when relevant provisions or clauses apply |
| Examples | General contracting, competition, and procurement rules | Defense-specific terms, including certain cybersecurity and sourcing clauses |
A DoD contract can contain both FAR and DFARS clauses. DFARS supplements the FAR; it does not replace it. Contractors may also encounter agency procedures, statutory requirements, and contract-specific provisions beyond these two regulations.
Does DFARS Apply to Commercial Products and Services?
Sometimes. The FAR and DFARS provide special rules for commercial products and commercial services, but commercial status does not automatically remove every defense-contract requirement. Some clauses apply to commercial acquisitions, while others may be excluded, limited, or modified under applicable rules.
Businesses should review the contract’s commercial-item treatment and each clause’s prescription and text. A product sold commercially to the public may still be purchased under a contract that includes specific DoD requirements. Conversely, a defense customer’s request does not by itself establish that every DFARS clause applies.
How to Check Whether DFARS Applies
- Identify the contracting relationship. Confirm whether the buyer is the DoD, a prime contractor, or another entity purchasing for a covered defense effort.
- Review the complete contract package. Check the solicitation, award, amendments, attachments, incorporated clauses, and any subcontract terms.
- Match clauses to the work. Look at each clause’s applicability conditions, definitions, exceptions, and flow-down instructions.
- Identify information and systems. Determine whether covered defense information is present and which systems, cloud services, or suppliers handle it.
- Verify current requirements. Use the official DFARS text and relevant DoD guidance; do not rely solely on an outdated summary or a generic compliance certificate.
- Document decisions and controls. Keep records of clause reviews, data classifications, supplier communications, assessments, and compliance actions.
For cybersecurity, the company should map where covered information enters, moves through, and leaves its environment. That includes relevant subcontractors and service providers. If a system boundary or data classification is uncertain, the contracting officer or prime should be asked for written clarification before the business makes unsupported assumptions.
Common Misunderstandings About DFARS
- “Every federal contractor must comply with all DFARS clauses.” DFARS is specific to DoD acquisitions, and individual clauses apply according to their terms and contract inclusion.
- “A company is compliant because it has a cybersecurity policy.” A policy is not proof that required technical and operational controls are implemented or that assessments and reporting duties have been met.
- “A prime contractor handles all compliance.” A prime may coordinate requirements, but subcontractors can have direct duties under flowed-down clauses.
- “Commercial products are always exempt.” Commercial status may affect which clauses apply, but does not automatically eliminate all defense-specific terms.
- “DFARS is a certification.” DFARS is a regulation supplement. Some associated programs involve assessments or certifications, but there is no single universal DFARS certificate that satisfies every requirement.
Official Sources for DFARS Information
The most reliable starting point is the official DFARS text on Acquisition.gov. The Federal Acquisition Regulation provides the government-wide rules that DFARS supplements. For cybersecurity standards, the National Institute of Standards and Technology publishes NIST SP 800-171; the contract and applicable DoD rules determine which requirements and version govern.
DoD’s CMMC program website provides official program information. Because acquisition rules and implementation schedules can change, contractors should confirm the current status and contract language when preparing an offer or planning compliance work.