Topic · 11 articles
DFARS
Every MacZine article on DFARS, newest first - written, reviewed and versioned in the open.
Subcontractor Cybersecurity: Your Sub's SPRS Score Is a Claim
Primes cannot see a sub's score in SPRS. Subcontractor cybersecurity requirements get verified with evidence - here is what to ask for.
An Incident Response Tabletop Exercise That Satisfies 3.6.3
An incident response tabletop exercise counts for NIST 800-171 3.6.3 only if it leaves evidence. How to seat, script, and document one an assessor accepts.
NIST 800-171 Rev 3 vs Rev 2: It Depends Who Signed the Contract
NIST 800-171 Rev 3 vs Rev 2: DoD still binds and scores Rev 2 while civilian CUI heads to Rev 3. What changed, the ID trap, and how to map once.
CMMC Class Deviation: The Phase 2 Pause Is Now in the Rulebook
The CMMC class deviation moved the Phase 2 pause from a policy memo into DFARS. A dated timeline of what each step changed, and what stays in force.
What Actually Makes a File CUI
CUI is a government designation, not a judgment you make on a file's contents. How marking, derivative marking, and decontrol actually work.
Read the Solicitation's Compliance Clauses Before You Bid
Compliance cost gets decided at bid or no-bid, not after award. A front-to-back read of the clauses, DD-254, and Section L/M that actually price it.
Can You Put CUI in an AI Tool? Read the Cloud Clause First
The DFARS clause that governs cloud service providers already answers whether CUI can go into an AI tool - most of the commercial tier fails it.
The 72-Hour Clock in DFARS 252.204-7012, Hour by Hour
DFARS 7012 gives you 72 hours to report a cyber incident to DoD. Walking the clock hour by hour shows where contractors actually lose the time.
How Your SPRS Score Is Actually Calculated
The DoD Assessment Methodology scores 110 controls on a 5/3/1 weighting and bottoms out at -203. Here is the arithmetic, and how a CO reads it.
DoD Paused CMMC Phase 2. Your Subcontract Flow-Down Didn't.
DoD suspended CMMC Phase 2's federal clause, but a prime's subcontract requirement is a separate instrument - and it doesn't lift itself.
CMMC Phase 2 Is Paused. Your Compliance Clock Isn't.
DoD paused CMMC Phase 2 certification to review the program - the DFARS and NIST 800-171 obligations under it did not. What to do during the review.