What changed on 13 July 2026, and what did not

The Contractor shall provide adequate security on all covered contractor information systems; for systems that are not part of an IT service or system operated on behalf of the Government, this means implementing the security requirements in NIST SP 800-171 in effect at the time the solicitation is issued (or as authorised by the Contracting Officer).

Cloud computing services provided as part of an IT service operated on behalf of the Government are subject to clause 252.239-7010; where the Contractor uses an external cloud service provider to store, process or transmit covered defense information, the Contractor shall require the provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with paragraphs (c) through (g) of this clause.

The Contractor may submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer for consideration by the DoD CIO, and may propose to use alternative but equally effective security measures; the Contracting Officer documents adjudication of any such requests.

When the Contractor discovers a cyber incident affecting a covered contractor information system, the covered defense information residing therein, or its ability to perform operationally critical support, it shall conduct a review for evidence of compromise and rapidly report the incident (within 72 hours of discovery) to DoD at https://dibnet.dod.mil, including the required report content, and shall have or acquire a DoD-approved medium assurance certificate to make the report.

When the Contractor or a subcontractor discovers and isolates malicious software in connection with a reported cyber incident, it shall submit the malicious software to the DoD Cyber Crime Center (DC3) in accordance with DC3 or Contracting Officer instructions, and shall not send malicious software to the Contracting Officer.

The Contractor shall preserve and protect images of all known affected information systems identified in the incident review and all relevant monitoring/packet-capture data for at least 90 days from submission of the cyber incident report, to allow DoD to request the media or decline interest.

Upon request, the Contractor shall provide DoD with access to additional information or equipment necessary to conduct a forensic analysis of a reported cyber incident.

If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with the media preservation paragraph.

Information shared by the Contractor under this clause that qualifies as contractor attributional/proprietary information is safeguarded and used by DoD subject to restrictions on use and release (whether or not created by or for DoD), and all activities under the clause are conducted in accordance with applicable law and regulation.

The safeguarding and cyber incident reporting required by this clause are in addition to, and do not abrogate, any other safeguarding or reporting requirements imposed by law or by other provisions of the contract.

The Contractor shall include this clause, without alteration except to identify the parties, in subcontracts (including for commercial products or services) for operationally critical support or whose performance will involve covered defense information, determine whether information retains its identity as covered defense information, and require subcontractors to report cyber incidents to the prime (or next higher-tier subcontractor) and to DoD via dibnet.