Guides Running a supplier program
A DFARS 7012 supplier questionnaire: what to ask and why
The 21 questions of a DFARS 252.204-7012 supplier cybersecurity questionnaire, the clause or rule each maps to, why it matters, and what a signed answer is not.
By Chris Edwards, Edwards Consulting Group · Updated
A DFARS 252.204-7012 supplier questionnaire asks a subcontractor the facts the clause and NIST SP 800-171 already require it to know about itself: whether it handles covered defense information, whether it has self-assessed and posted a score in SPRS, whether it has a system security plan, whether it can report a cyber incident within 72 hours, and whether it flows the clause down. Below are the 21 questions of Tiermark's baseline questionnaire, word for word, with the paragraph each maps to and why it matters. A signed answer is the supplier's attestation; it is not evidence and it is not an assessment.
This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.
Why a prime asks its suppliers at all
DFARS 252.204-7012 (m)(1) tells the prime to include the clause "without alteration" in subcontracts that involve covered defense information, and to "determine if the information required for subcontractor performance retains its identity as covered defense information". DFARS 252.204-7021 (f)(2) says that before awarding a subcontract the prime must "ensure that the subcontractor has a current CMMC certificate or current CMMC status" at the right level. Neither clause says how, and no public rule lets a prime look up a subcontractor's score in SPRS. So the prime asks, and keeps the answer; see How primes check their suppliers' cybersecurity.
The questions, section by section
The questionnaire has seven sections and 21 questions. Answers are yes or no (two questions allow "Not applicable"), a number, a date, a short text or a choice from a list. Every question is required unless marked optional. The text below is version 1 of the questionnaire as published; a later version would be a new version, never an edit to this one.
Scope
| Question | Maps to | Why it matters |
|---|---|---|
| Does your company process, store, or transmit Covered Defense Information (CDI or CUI) under any DoD contract or subcontract? | 7012(a), the definitions of "covered defense information" and "covered contractor information system"; 7012(m)(1) | If the answer is no, the safeguarding and reporting duties do not reach the supplier's systems. This answer decides whether several later answers count as findings at all. |
| Briefly describe the systems or environments where CDI is handled (for example, an on-premises file server, a GCC High tenant, a segmented enclave). Optional. | 7012(a), "covered contractor information system" | Says what the rest of the answers are about. A description of the environment, never the information itself. |
Assessment and SPRS
| Question | Maps to | Why it matters |
|---|---|---|
| Have you completed a NIST SP 800-171 self-assessment using the DoD Assessment Methodology? | 32 CFR 170.16(a)(1); scoring in 170.24 | Without one there is no score and no basis for one. |
| Date of the most recent self-assessment. | 170.16(a)(1): "every three years" | The three-year clock runs from it. 7021(a) defines a Final Level 2 (Self) status as current only if "Not older than 3 years". |
| Is your summary-level score posted in the Supplier Performance Risk System (SPRS)? | 170.16(a)(1), "submit assessment results in Supplier Performance Risk System (SPRS)"; 170.16(b) | A posted result and an affirmation are the two conditions of award for a Level 2 (Self) requirement, and a prime cannot see the posting itself. |
| Your current SPRS score (from 110 down to negative 203). | 170.16(a)(1)(i)(E); 170.24(c)(2) | 88 or more is the least that supports a Conditional status. See The SPRS score explained. |
| Date the SPRS score was posted or last updated. | 170.16(a)(1) | Shows whether the posting was current when you awarded, and when the next one is due. |
Documentation
| Question | Maps to | Why it matters |
|---|---|---|
| Do you maintain a System Security Plan (SSP) covering every system that handles CDI? | NIST SP 800-171 3.12.4; 32 CFR 170.21(a)(2)(iii) | A system security plan can never be on a POA&M. Without one the other controls cannot be shown to apply anywhere in particular. |
| Do you maintain a Plan of Action and Milestones (POA&M) for requirements not yet implemented? | NIST SP 800-171 3.12.2; 170.21 | The plan is what gives each open requirement a date; 170.16(a)(1)(i)(F) makes "POA&M usage" an input to SPRS. |
| Number of NIST SP 800-171 requirements not yet fully implemented. | 170.21(a)(2); 170.24 | Each one is a deduction from the score and a line the plan has to close. Above 22 points open, no Conditional status is possible; see POA&M rules. |
Incident reporting
| Question | Maps to | Why it matters |
|---|---|---|
| Can you discover, report to DoD through DIBNet, and preserve evidence of a cyber incident within 72 hours, as the clause requires? | 7012(a), "Rapidly report" means "within 72 hours of discovery of any cyber incident"; (c)(1)(ii); (e) | The one obligation in 7012 with a clock on it. Evidence must be preserved "for at least 90 days from the submission of the cyber incident report". |
| Does your company hold a DoD-approved medium assurance certificate for DIBNet reporting? | 7012(c)(3) | The clause makes it a condition of reporting: "the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents". Getting one takes time, so ask before an incident. |
| Has any cyber incident affecting CDI occurred in the past twelve months? | 7012(c)(1); (m)(2)(ii) | A subcontractor must "Provide the incident report number, automatically assigned by DoD, to the prime Contractor"; the answer says whether you should have received one. |
| If yes, was it reported to DoD, and when? Optional. | 7012(c)(2); (m)(2)(ii) | A sentence, not the report. The detail belongs in the supplier's own DIBNet submission. |
Key controls
| Question | Maps to | Why it matters |
|---|---|---|
| Is multifactor authentication enforced for every user account with access to systems handling CDI, including privileged and remote access? | NIST SP 800-171 3.5.3 | A 5-point requirement under 170.24, 3 points when MFA covers only remote and privileged users, and never allowed on a POA&M. |
| Is FIPS 140 validated cryptography used to protect CDI at rest and in transit? | NIST SP 800-171 3.13.11; 170.21(a)(2)(ii) | 5 points with no encryption; 3 points, and allowed on a POA&M, when encryption is in place but not FIPS-validated. |
| If a cloud service processes or stores CDI, does it meet FedRAMP Moderate or an equivalent baseline, as 252.204-7012(b)(2)(ii)(D) requires? | 7012(b)(2)(ii)(D) | The clause requires "security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline". "Not applicable" means no cloud service holds CDI, and is not a finding. |
Flow-down and CMMC
| Question | Maps to | Why it matters |
|---|---|---|
| Do you flow DFARS 252.204-7012 down to your own subcontractors that handle CDI? | 7012(m)(1) | The obligation follows the information down the chain, and so does the exposure of the prime that sent it. "Not applicable" means no subcontractor handles CDI. |
| Your current CMMC status. (Not started; Level 1 self-assessment affirmed; Level 2 self-assessment affirmed; Level 2 certification assessment scheduled; Level 2 certified; Not applicable, no CDI) | 7021(d)(1) and (f)(2); 32 CFR 170.23 | The status 7021 asks you to ensure before award. Since July 13, 2026 only Level 1 (Self) and Level 2 (Self) may be named in new requirements; see CMMC Phase II is suspended. |
Attester
| Question | Maps to | Why it matters |
|---|---|---|
| Full name of the person attesting. | 32 CFR 170.22(a)(1), by analogy | A statement is only as good as who made it. 170.22 makes the Affirming Official "responsible for ensuring the OSA's compliance"; ask for someone at that level. |
| Title. | 170.22(a)(2)(i), by analogy | The affirmation in SPRS carries "Name, title, and contact information"; the questionnaire asks for the first two. |
The signer then accepts one sentence: "I affirm that the answers above are accurate to the best of my knowledge, that I am authorized to make this attestation for the company named, and that I will notify the requesting prime of any material change."
Signed attestation vs evidence
The answers are the supplier's statement about itself. The evidence behind them stays with the supplier: the system security plan, the assessment worksheets, the SPRS entry, the plan of action. Under 32 CFR 170.16(c)(4) a supplier keeps its assessment artifacts "for six (6) years from the CMMC Status Date", and under 252.240-7997(c) it gives the Government access for a Medium or High assessment. A prime does not need the artifacts; it needs a signed, dated answer it can produce later. Never ask a supplier to send controlled unclassified information with its answers.
Why a questionnaire is not an assessment
A CMMC Level 2 self-assessment is conducted "in accordance with NIST SP 800-171A" against the assessment objectives of each requirement (170.16(c)(1)), and a Medium or High assessment is "conducted by Government personnel" (252.240-7997(a)). A questionnaire asks 21 questions and takes about ten minutes. It does not score anything, change a SPRS entry or create a CMMC status. It records, over a named person's signature, where the supplier says it stands on the facts the clauses turn on. The incident questions are a starting point; the reporting duty itself is in Cyber incident reporting.
Where Tiermark fits
Tiermark's campaigns send this questionnaire, the DFARS 252.204-7012 baseline, to chosen suppliers on a prime's map with a due date and reminders. A supplier answers for free; its answers come back signed by a named person, immutable, with a SHA-256 content hash, and can be shared with other primes that ask; see Answering a request. The answers are shown as the supplier's own statements, not checked against SPRS. Thirteen rules over the yes-or-no, number and choice answers can write items into the prime's risk register.
Sources
Still have a question?
Write to help@tiermark.io and a person will answer.