DFARS Compliance Services

DFARS means putting in place NIST 800-171 and self-attesting via an SSP. CMMC means a third-party assessor certifies you. DFARS applies today to DoD contracts with CUI; CMMC will phase in and eventually require certification. Right now you need DFARS (NIST 800-171). Doing DFARS well sets you up for CMMC—both use the same 110 controls. Difference: DFARS = self-assessment; CMMC = third-party certification.

Costs depend on your current posture and scope. Small shops with some controls in place often spend $15K–$35K upfront plus $2K–$4K/year. Medium shops with bigger gaps: $35K–$75K. Large or complex: $75K–$150K+. You pay for gap assessment, controls, SSP, POA&M, and incident response. DFARS is self-attestation, so no third-party assessment fee. Non-compliance usually costs more: lost contracts and incident-related penalties.

DFARS 252.204-7012 says you must report cyber incidents that affect CUI to the DoD Cyber Crime Center within 72 hours. A “cyber incident” is unauthorized access, use, disclosure, change, or destruction of CUI or your systems. You report what happened, what CUI was involved, and a point of contact. You must preserve system images and media for 90 days. Missing the 72-hour window can mean compliance failures and False Claims Act risk. Good incident procedures make sure you spot reportable events and report on time.

If you already have solid security, often 3–5 months. From a weak baseline, 6–9 months. Steps: gap assessment (2–3 weeks), CUI scoping (1–2 weeks), control implementation (8–20 weeks), SSP (3–4 weeks), POA&M (1–2 weeks), incident procedures (2–3 weeks). You can attest with a POA&M for open gaps; you don’t need everything perfect day one. Many teams reach attestable compliance in 90–120 days and close gaps via POA&M.

Usually yes. You’ll need some upgrades—often MFA, encryption for CUI, better logging, and separating CUI systems from the rest of the network. We assess what you have and recommend changes. Most of the time 70–80% of your gear stays; you improve security rather than replace everything. Only systems that touch CUI need full NIST 800-171. Email, HR, and other non-CUI systems can stay separate with basic security.