DFARS 252.204-7012 - Safeguarding Covered Defense Information (CDI)

This clause requires contractors to protect covered defense information by implementing NIST SP 800-171 security controls, reporting cyber incidents within 72 hours, and ensuring subcontractors also comply. It establishes safeguarding, incident-reporting, and flow-down obligations for all DoD contracts involving CDI.