# Class Deviation 2024-O0013
# Class Deviation 2024-O0013 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Status: Archived
Date Issued: Effective immediately (memorandum undated, deviation clause dated May 2024)
Signed By: John M. Tenaglia, Principal Director, Defense Pricing and Contracting
Scope: All DoD contracting officers under USCC, USSOCOM, USTRANSCOM, Army, Navy, Air Force and Defense Agencies and DoD Field Activities
Authority: Defense Federal Acquisition Regulation Supplement (DFARS) class deviation authority

## Summary

This deviation requires contracting officers to use a modified version of DFARS clause 252.204-7012 in all applicable contracts. The key change locks the required cybersecurity standard to NIST SP 800-171 Revision 2, rather than the version of that publication in effect at the time of solicitation or as otherwise authorized by the contracting officer. The deviation remains in effect until rescinded.

## Required Contracting Officer Actions

1. Use the attached deviation clause 252.204-7012 (DEVIATION 2024-O0013) in lieu of the standard DFARS clause 252.204-7012 in all applicable solicitations and contracts, effective immediately
2. Ensure that contracts subject to 252.204-7012 reference NIST SP 800-171 Revision 2 specifically, rather than the version in effect at the time of solicitation or as otherwise authorized

## Affected Provisions and Clauses

### 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (Clause)
- Prescribed in: 204.7304(c)
- Change type: REPLACED
- Action: Replace the standard DFARS clause in its entirety with the deviation version, which mandates NIST SP 800-171 Revision 2 specifically

## Notes

Duration: The deviation remains in effect until rescinded. Contracting officers should monitor for any rescission notice.

Point of Contact: Questions may be directed to Col Jason Holman at jason.m.holman.mil@mail.mil.

Subcontracts: The clause must be flowed down to subcontracts involving operationally critical support or covered defense information, including subcontracts for commercial products or commercial services, without alteration except to identify the parties.

## Suggested Questions

You can ask your AI assistant:
- What actions do I need to take for this deviation?
- Does this deviation affect commercial acquisitions under Part 12?
- Which clauses need to be removed from my existing contracts?
- How does this deviation change 252.204-7012 specifically?
- Are there any SAM registration implications?

---
Source: https://part52.dev
Generated: 2026-03-20
Memorandum: https://web.archive.org/web/20251031125535id_/https://www.acq.osd.mil/dpap/policy/policyvault/USA000814-24-DPC.pdf