Frequently Asked Questions

Defense contractors on certain contracts must keep a drug-free work force program under the DFARS clause at 48 CFR 252.226-7003, Drug-Free Work Force (Aug 2024). Before August 2024 the clause was numbered 252.223-7004 (89 FR 66283). The policy at DFARS 226.570-1 is that DoD contractors maintain a program for achieving a drug-free work force. This DFARS clause is in addition to the FAR drug-free workplace clause, whose duties are covered in drug-free workplace program components.

When the clause applies. Under DFARS 226.570-2, contracting officers use the clause in solicitations and contracts that involve access to classified information, or when the contracting officer decides it is needed for national security or to protect health or safety. The clause is not used for commercial products and commercial services, for work performed outside the United States and its outlying areas unless the contracting officer decides otherwise, or at or below the simplified acquisition threshold.

Program elements. The contractor's program must include the following, or appropriate alternatives:

• Employee assistance programs with education, counseling, rehabilitation and links to community resources.
• Supervisory training to help identify and address illegal drug use.
• Self-referrals and supervisory referrals to treatment, with maximum respect for confidentiality consistent with safety and security.
• A way to identify illegal drug users, including testing on a controlled and carefully monitored basis.

Who is tested. The contractor must test employees in sensitive positions. These are employees with access to classified information and others the contractor decides hold positions involving national security, health or safety, or a high degree of trust. The contractor sets the extent and criteria for testing based on the nature of the work, the employee's duties and the risks. The contractor may also test on reasonable suspicion, after an accident or unsafe practice, as part of or after counseling or rehabilitation, under a voluntary program, and for applicants. Testing may be limited to the drugs listed in the HHS Mandatory Guidelines. The clause defines illegal drugs as Schedule I and II controlled substances whose possession is unlawful, not drugs used under a valid prescription.

After a positive finding. Contractors must adopt personnel procedures for employees found using illegal drugs. An employee found using illegal drugs may not remain on duty or work in a sensitive position until the contractor decides, under its own procedures, that the employee may return.

State law and bargaining agreements. The testing provisions do not apply to the extent they conflict with state or local law or an existing collective bargaining agreement, and conflicts with an agreement become a subject for the next bargaining session. The FAQ on who requires non-DOT drug testing gives more context.

Supervisor training. Supervisory training is a listed program element. The FAQ on reasonable suspicion training for supervisors explains what that training covers.

The Cybersecurity Maturity Model Certification (CMMC) program sets cybersecurity assessment requirements for defense contractors and subcontractors. The program rule is at 32 CFR Part 170 (89 FR 83092, effective December 16, 2024), and the DFARS acquisition rule at 48 CFR 204.75 and clause 252.204-7021 (90 FR 43560) took effect November 10, 2025. The Learn Laws® news item on DoD regulatory priorities covers the rollout.

Who is covered. Part 170 applies to DoD contract and subcontract awardees that will process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor information systems (32 CFR 170.3). It covers commercial item acquisitions above the micro-purchase threshold, except those only for commercially available off-the-shelf items. It does not apply to federal systems that contractors operate for the government.

The three levels.

• Level 1. The 15 basic safeguarding requirements in FAR 52.204-21(b)(1). An annual self-assessment with each requirement met is needed, and plans of action are not allowed (32 CFR 170.15).
• Level 2. The requirements of NIST SP 800-171 Revision 2. Depending on the contract, this is a self-assessment or a certification assessment by an authorized third-party assessment organization (C3PAO) (32 CFR 170.16 and 170.17).
• Level 3. Selected requirements from NIST SP 800-172, assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DCMA DIBCAC). A Final Level 2 (C3PAO) status for the same systems is a prerequisite (32 CFR 170.18).

Status and award. Contracting officers check the Supplier Performance Risk System (SPRS) and may not award to an offeror without a current CMMC status at the required level or higher (48 CFR 204.7503). Levels 2 and 3 can be held in a conditional status for up to 180 days, and award can occur at that status, but Level 1 requires a final status (48 CFR 204.7502). Under 252.204-7021, Final Level 2 and Level 3 statuses are current for up to 3 years, and each status needs an affirmation of continuous compliance by an affirming official at least annually.

Phased rollout. Phase 1 began with the DFARS rule and focuses on Level 1 and Level 2 self-assessments. Phase 2 begins November 10, 2026, one calendar year after Phase 1, and adds Level 2 C3PAO requirements for applicable contracts (32 CFR 170.3(e)). Phases 3 and 4 follow at one-year intervals, ending in full implementation, including option periods (32 CFR 170.3(e)).

Related clauses. CMMC sits alongside the safeguarding and incident reporting duties in DFARS 252.204-7012. The FAQ on the DFARS 72-hour cyber incident reporting rule covers reporting duties under the 7012 clause. Training staff on handling controlled information is part of compliance training, and the FAQ on what HIPAA training involves shows a similar approach to role-based data security training.

Defense contractors that hold covered defense information must report cyber incidents to DoD within 72 hours of discovery. The rule is the DFARS clause at 48 CFR 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024). The clause defines rapidly report as within 72 hours of discovery of any cyber incident.

What counts as a cyber incident. A cyber incident is an action taken through computer networks that results in a compromise, or an actual or potentially adverse effect, on an information system or the information in it. The reporting duty applies when the incident affects a covered contractor information system or the covered defense information on it, or affects the contractor's ability to perform operationally critical support identified in the contract.

Steps after discovery. Under paragraph (c), the contractor must:

• Review for evidence of compromise of covered defense information, including compromised computers, servers, data and user accounts, and other systems on the network that may have been accessed.
• Rapidly report the incident to DoD at dibnet.dod.mil.
• Hold a DoD-approved medium assurance certificate to submit the report.

Malicious software. If the contractor finds and isolates malicious software tied to the incident, it submits the software to the DoD Cyber Crime Center (DC3), not to the contracting officer (paragraph (d)).

Preservation and access. The contractor must preserve images of known affected systems and relevant monitoring and packet capture data for at least 90 days from the report, so DoD can request the media or decline interest (paragraph (e)). On request, the contractor gives DoD access to information or equipment needed for forensic analysis (paragraph (f)). If DoD conducts a damage assessment, the contracting officer requests the needed information.

Subcontractors. The prime contractor must include the clause in subcontracts for operationally critical support or that involve covered defense information, including commercial subcontracts. Subcontractors report incidents directly to DoD and give the DoD-assigned incident report number to the prime or next higher-tier subcontractor as soon as practicable (paragraph (m)).

Security baseline. The same clause requires adequate security, including NIST SP 800-171 for covered contractor systems not operated for the government. Contractors required to implement NIST SP 800-171 need a current Basic NIST SP 800-171 DoD Assessment, not more than 3 years old unless the solicitation specifies a shorter period, at award (DFARS 204.7302). CMMC assessments under 32 CFR Part 170 build on these requirements, and the FAQ on CMMC requirements for defense contractors covers that program.

Other reporting rules. Contractors may face separate reporting duties under other contracts or laws, and the clause does not replace them. Incident response plans and staff training on reporting steps help meet the 72-hour window, as covered in compliance training. The Learn Laws® news item on DoD regulatory priorities covers related cybersecurity rules.