DFARS Cybersecurity and Data Rights: Risk Points for Technology Subcontractors

A DoD subcontract can introduce cybersecurity and data-rights requirements that are not part of a typical commercial agreement. Technology companies, MSPs, software firms, engineering businesses, and other service providers should identify those obligations before they price the work or connect government information to their systems.

The first step is to separate the issues. Cybersecurity requirements such as DFARS 252.204-7012 and CMMC address information and system protections. Technical data and software clauses address rights in deliverables, background technology, markings, assertions, and licenses. Both can appear in the same subcontract, but they require different review questions.

1. Identify the Cybersecurity Flowdowns

Check the subcontract for DFARS cybersecurity clauses, CMMC language, NIST SP 800-171 requirements, SPRS obligations, incident-reporting duties, cloud requirements, and any prime-specific security attachments.

Applicability is contract- and scope-specific. The important questions are what information your company will process, store, or transmit; which information systems will be used; and what lower-tier requirements apply if you pass information to a supplier.

For the current 2026 rule and subcontract flowdown requirements, read CMMC Requirements for DoD Subcontractors in 2026.

2. Separate FCI, CUI, and the Systems in Scope

Do not assume that every employee, device, or corporate system is automatically in the same compliance boundary. Identify the information that will be handled and the systems that will actually process, store, or transmit it during performance.

If the prime sends a standard cybersecurity exhibit, ask whether the required level and controls match the information being flowed down. A clear information-flow description makes the technical and contractual review much easier.

3. Review Technical Data and Software Rights Separately

Government data and software rights are not a simple ownership rule. Rights can depend on the applicable DFARS clause, the type of technical data or software, development funding, markings, assertions, deliverable requirements, and whether the material existed before the contract.

• Background IP: Identify pre-existing software, methods, tools, data, templates, and know-how before work starts.
• Deliverables: Confirm exactly what technical data, software, source code, documentation, or other material must be delivered.
• License rights: Separate Government rights from any additional rights the prime asks to receive.
• Markings and assertions: Identify any steps required to preserve the intended rights in restricted or proprietary material.

4. Build the Questions Before Attorney Review

A useful first-pass review should identify the cyber clauses, CMMC level, FCI/CUI references, system obligations, technical-data clauses, software-rights provisions, background-IP language, and missing attachments. Counsel can then focus on applicability, negotiation language, required markings or assertions, and final legal judgment.