A DFARS 252.204-7012 playbook directs fast triage, evidence preservation, DIBNet reporting, and DC3 malware submission, mapped to NIST SP 800-171 incident response controls and grounded in your Microsoft cloud footing.
Prime contractors flow CUI obligations to subcontractors based on the specific data shared and the clauses in the subcontract, then add business terms that often raise the bar beyond the regulatory floor.
DFARS 252.204-7021 ties CMMC directly to DoD contracts and directs primes to flow the required level to subcontractors that handle FCI or CUI, with assessment specifics governed by 32 CFR part 170 and DoD guidance.