DFARS 252.204-7012
DFARS 252.204-7012 is the Defense Department contract clause that requires contractors handling covered defense information to protect it with NIST SP 800-171 controls and to report cyber incidents.
The clause is titled Safeguarding Covered Defense Information and Cyber Incident Reporting. It requires "adequate security" for covered defense information, which in practice means implementing NIST SP 800-171, rapid reporting of cyber incidents to DoD, and flowing the clause down to subcontractors who handle that information. A small shop usually meets it through a prime's purchase order, not a direct DoD contract.
It also reaches into the cloud. Under a December 2023 DoD CIO memo, any cloud service that stores covered defense information has to meet FedRAMP Moderate or an equivalent, backed by a third-party assessment. As of October 2026, CMMC Phase 2 requirements are suspended pending a review, but 7012 is not: it still applies wherever it's in your contracts, alongside SPRS self-assessment scores.
Traveler doesn't make a shop 7012 compliant; that depends on your whole environment. Shop Server Defense ($6,500 one time) is designed to support the requirements for your shop system by keeping covered defense information on hardware you own, with an 800-171 control mapping and SSP template excerpt for your documentation.
Related
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: Is My Shop Data CUI or ITAR-Controlled? (2-Minute Check) →