Procurement workflow surface
A procurement officer evaluating a vendor against DFARS Subpart 252.204 (Safeguarding Covered Defense Information and Cyber Incident Reporting) can use this page to walk the operative articles + paragraphs the instrument touches, anchored to the primary source. Each row groups every coverage cell that names that article so the reader sees WHICH governance topic each clause speaks to. Use it as a checklist scaffold, not as legal advice (see charter §7.4).
252.204-7012 — training-data sets stored on covered contractor information systems require NIST SP 800-171 implementation when designated CDI; data-spill / exfiltration events trigger 72-hour cyber-incident reporting under 252.204-7012(c)
Verbatim text:
“When the Contractor discovers a cyber incident that affects a covered contractor information system … the Contractor shall … rapidly report cyber incidents to DoD … within 72 hours of discovery.”
National Security Carveouts in AI Regulation
252.204-7012 + CMMC clauses (-7019/-7020/-7021) are the operative national-security-overlay framework for defence-acquisition information security; the subpart IS the carveout regime
Verbatim text:
“The Contractor shall provide adequate security on all covered contractor information systems … by implementing NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems…”
252.204-7012 — AI-system source code, model weights, training data fall within Covered Defense Information scope when the underlying contract designates these as CDI; foundation-model artefacts are CDI through the standard contract designation pathway
Editor rationale: DFARS 252.204 is model-architecture-agnostic; foundation-model artefacts get CDI protection via contract-designation rather than via a foundation-model-specific clause.
Verbatim text:
Verbatim text not yet transcribed — see primary source.
Cyber-incident reporting under 252.204-7012(c) — 72-hour DoD notification covers AI-system compromise events including model-weight theft + prompt-injection-based credential exposure; broader AI-use disclosure flows through M-24-10 not DFARS
Editor rationale: DFARS reporting is incident-driven (security events) rather than steady-state AI-use disclosure; the cell uses compute_reporting as the closest existing topic following the OMB-M-24-10 + GSA-AI-GUIDE precedent.
Verbatim text:
Verbatim text not yet transcribed — see primary source.