DFARS Subpart 252.204 (Safeguarding Covered Defense Information and Cyber Incident Reporting) — vendor disclosure form

1. Vendor identification

2. AI system identification

3. Provision-specific questions

1. Training-Data Rights. Identify the legal basis for training-data sourcing for the offered system (including copyright, consent, and any text-and-data-mining exemptions relied upon) and confirm consistency with DFARS Subpart 252.204 (Safeguarding Covered Defense Information and Cyber Incident Reporting) (252.204-7012 — training-data sets stored on covered contractor information systems require NIST SP 800-171 implementation when designated CDI; data-spill / exfiltration events trigger 72-hour cyber-incident reporting under 252.204-7012(c)).

   (Cite: 252.204-7012 — training-data sets stored on covered contractor information systems require NIST SP 800-171 implementation when designated CDI; data-spill / exfiltration events trigger 72-hour cyber-incident reporting under 252.204-7012(c))

2. National Security Carveouts in AI Regulation. Identify whether any component of the offered system or its use case falls within the national-security carveouts of DFARS Subpart 252.204 (Safeguarding Covered Defense Information and Cyber Incident Reporting) (252.204-7012 + CMMC clauses (-7019/-7020/-7021) are the operative national-security-overlay framework for defence-acquisition information security; the subpart IS the carveout regime) and the resulting compliance posture.

   (Cite: 252.204-7012 + CMMC clauses (-7019/-7020/-7021) are the operative national-security-overlay framework for defence-acquisition information security; the subpart IS the carveout regime)

4. Documentation enclosures expected

Tick each enclosure attached to the vendor response. Missing enclosures should be explained in the “Variances” field below.

• Training-data summary / provenance log
• Copies of submitted regulatory reports / registrations
• Vendor company registration + insurance certificates
• Sub-processor / supply-chain list (including model upstream)

5. Vendor attestation

The undersigned, on behalf of the vendor, attests that the disclosures above are true and complete to the best of their knowledge at the date signed, and undertakes to notify the buyer in writing within 30 days of any material change to those disclosures.