Key takeaways

  • DFARS 252.204-7012 paragraph (b)(2)(ii)(D) applies when you use an external cloud service provider to store, process or transmit covered defense information. You must require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline.
  • The same paragraph requires the provider to comply with paragraphs (c) through (g) of the clause: incident reporting, malicious software, media preservation, access for forensic analysis and damage assessment.
  • The cleanest answer is a cloud offering that is FedRAMP Authorized at Moderate or higher on the FedRAMP Marketplace. Authorization belongs to a specific offering, not to a company name.
  • "Equivalent" is a DoD policy test, not a marketing phrase. It is about the full Moderate baseline assessed by an independent assessor, not a partial match or a self-declaration.
  • For CMMC Level 2, 32 CFR 170.16 repeats the two paths (authorized, or equivalent in accordance with DoD policy) and says the shared-responsibility matrix must be reflected in your system security plan.
  • A SOC 2 report, an ISO 27001 certificate or a statement that a provider is "aligned with NIST" is useful evidence, but none of them is FedRAMP Moderate equivalency on its own.

The rule in one paragraph

DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, has a paragraph about cloud services inside its rules for contractor systems. Paragraph (b)(2)(ii)(D) reads, in substance: if you intend to use an external cloud service provider to store, process or transmit any covered defense information in performance of the contract, you must require and ensure that the provider meets security requirements equivalent to those established by the government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline, and that the provider complies with paragraphs (c) through (g) of the clause.

Covered defense information, or CDI, is the clause's term for certain unclassified information tied to the contract. Most small contractors know the same material as Controlled Unclassified Information, or CUI, for example export-controlled drawings or technical data. FedRAMP is the federal program that assesses and authorizes cloud services for government use. The Moderate baseline is its middle level, built on NIST SP 800-53 controls.

Two duties, not one

Read the paragraph twice, because it asks for two different things. The first is the security level: FedRAMP Moderate or equivalent. The second is the incident machinery. Paragraphs (c) through (g) are the sections on reporting a cyber incident to DoD within 72 hours, handling malicious software, preserving images and monitoring data for at least 90 days, giving DoD access for forensic analysis, and supporting damage assessment. A cloud provider that has a Moderate authorization but whose contract with you does not carry these duties leaves a gap on the second half.

In practice that means two documents to look at. One is the provider's authorization or equivalency evidence. The other is the contract, terms of service or addendum between you and the provider, which has to say who reports what, how fast, and who keeps the evidence.

Authorized versus equivalent

There are two ways a provider can satisfy the paragraph. The first is that the specific cloud offering is FedRAMP Authorized at the Moderate baseline or higher, and appears on the FedRAMP Marketplace. You can check that yourself without asking the provider's sales team. Look for the offering by its product name, not just the company's name, because a company can have one authorized offering and several that are not.

The second path is equivalency. DoD issued a policy memorandum in late 2023 that explains what it expects before it will treat an offering as equivalent to FedRAMP Moderate. The memorandum is DoD policy, not part of the clause text, and the clause points to it by saying equivalent security requirements. In plain terms, equivalency is meant to be a high bar: the provider's offering is assessed against the whole Moderate baseline by a FedRAMP-recognized third-party assessment organization, the provider can show the body of evidence from that assessment, and it keeps up the security work afterward. It is not a promise that a provider has most of the controls, and it is not an assessment you can do yourself on the provider's behalf.

Read the memorandum itself before you rely on a provider's claim. It is published by the DoD Chief Information Officer, and its wording controls, not this summary.

What the CMMC rule adds

The CMMC program rule, 32 CFR Part 170, handles this for contractors that need CMMC Level 2. Section 170.16 says an organization seeking assessment may use a cloud service provider to process, store or transmit CUI when the offering is FedRAMP Authorized at Moderate or higher, or when it is not authorized but meets security requirements equivalent to the Moderate baseline, with equivalency determined in accordance with DoD policy. It also says the provider's customer responsibility matrix must be documented or referred to in the organization's system security plan, and that the organization's on-premises infrastructure connecting to the cloud offering is part of the assessment scope.

The customer responsibility matrix is a table the provider publishes that says which controls the provider performs, which you perform, and which are shared. Many failed assessments of cloud environments come from the middle column: both sides assumed the other one did it.

What equivalent does not mean

  • A SOC 2 report. It covers a provider's own control objectives, not the FedRAMP Moderate baseline.
  • An ISO/IEC 27001 certificate. It certifies a management system, not a control set equal to Moderate.
  • A statement that the provider is aligned with, built on or inspired by NIST SP 800-53 or 800-171.
  • A U.S. data center or U.S. staff alone. Location helps with some export-control questions, but it is a different requirement.
  • A product that is authorized for one agency's use but is a different offering from the one you buy. Check the exact offering.

A checklist to run before CUI moves

  • Write down every cloud service that will store, process or transmit CUI. Include email, file sharing, backup, ticketing, chat, a PDF tool and any AI assistant someone connects to files. The clause is about any external cloud service provider, not only the big platform.
  • For each, find the offering on the FedRAMP Marketplace at Moderate or higher. If it is not there, ask for the provider's written equivalency evidence and read it against the DoD memorandum.
  • Ask for the customer responsibility matrix and map your half of it into your system security plan.
  • Get the incident duties in writing: how fast the provider tells you, how it preserves evidence for at least 90 days, and how DoD gets access if it asks.
  • Check that the provider's subcontractors, for example a hosting layer, are covered by the same chain.
  • Decide the fallback. If one service fails the test, which CUI stays out of it, and which enclave or other service takes it?
  • Tell your prime which services you use. Primes often want to review them before award.

Where this meets your SPRS score

A cloud service that does not meet the standard is not just a paperwork problem. It can make requirements in the system security plan untrue, and a score or a CMMC status built on an untrue plan is a statement to the government that you may have to correct. Settle the cloud question before you post a score, not after.

We can map your CUI data flows, check each cloud service against the rule, and build the system security plan section that describes the shared responsibilities, as scoped and authorized work. We do not issue equivalency determinations, which belong to DoD and the provider's assessor, and we do not give legal advice; your contract decides what applies to you.

Sources

This article is general information, not legal, contracting or technical advice for your environment. Contract clauses, DoD policy and certification rules are set by the Department of Defense and your contract; confirm what applies to you with your prime, your contracting officer and counsel. Last reviewed .

Next article

Related reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity