Topic · 7 articles
DFARS
Every MacZine article on DFARS, newest first - written, reviewed and versioned in the open.
What Actually Makes a File CUI
CUI is a government designation, not a judgment you make on a file's contents. How marking, derivative marking, and decontrol actually work.
Read the Solicitation's Compliance Clauses Before You Bid
Compliance cost gets decided at bid or no-bid, not after award. A front-to-back read of the clauses, DD-254, and Section L/M that actually price it.
Can You Put CUI in an AI Tool? Read the Cloud Clause First
The DFARS clause that governs cloud service providers already answers whether CUI can go into an AI tool - most of the commercial tier fails it.
The 72-Hour Clock in DFARS 252.204-7012, Hour by Hour
DFARS 7012 gives you 72 hours to report a cyber incident to DoD. Walking the clock hour by hour shows where contractors actually lose the time.
How Your SPRS Score Is Actually Calculated
The DoD Assessment Methodology scores 110 controls on a 5/3/1 weighting and bottoms out at -203. Here is the arithmetic, and how a CO reads it.
DoD Paused CMMC Phase 2. Your Subcontract Flow-Down Didn't.
DoD suspended CMMC Phase 2's federal clause, but a prime's subcontract requirement is a separate instrument - and it doesn't lift itself.
CMMC Phase 2 Is Paused. Your Compliance Clock Isn't.
DoD paused CMMC Phase 2 certification to review the program - the DFARS and NIST 800-171 obligations under it did not. What to do during the review.