# DoD Requires CUI Security Controls

DFARS 252.204-7012 requires Department of Defense contractors handling controlled unclassified information (CUI) to implement the security requirements in NIST SP 800-171, described in the signal as 110 security controls. For procurement teams and contractors, this applies to relevant DoD contract work and subcontractor flowdowns; the signal reports no new rule, compliance deadline, or implementation guidance.

- Contractors should check applicable contract clauses and confirm that required security practices are reflected in systems handling CUI.
- Prime contractors should verify that relevant security requirements are flowed down to subcontractors handling CUI.
- The signal identifies an existing contractual security obligation, not a new procurement opportunity or a change in requirements.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity
**Published:** October 12, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Sources
- [DFARS 252.204-7012 requires DoD contractors to implement the 110 security controls in NIST SP 800-171 to protect CUI.  
https://t.co/6ybSDEK7ke  
#Cybersecurity #CMMC https://t.co/Y6SGTrveFz](https://x.com/RightHandTech/status/2109671963907981780) - twitter-govtech