DFARS 252.204-7012
Safeguarding Covered Defense Information and Cyber Incident Reporting
What it says
Where covered defense information (CDI/CUI) is involved, requires NIST SP 800-171 security controls on contractor systems and rapid reporting (72 hours) of cyber incidents to DoD.
Why it matters on DIBBS
Many simple hardware buys involve no CUI — but if your solicitation package includes controlled technical drawings, this clause and NIST 800-171 apply to the systems that store them.