Cloud Computing Services on DoW Contracts: What DFARS 252.239-7010 Requires of SaaS Companies

A SaaS company that already sells to civilian agencies often assumes the Department of War (DoW) works the same way: get a FedRAMP authorization, get an agency to issue an ATO, start selling. The DoW adds its own layer. Its acquisition supplement, the DFARS, has a subpart on cloud computing and a contract clause, DFARS 252.239-7010, Cloud Computing Services, that sets who may be awarded a cloud contract, where the data lives, what the vendor may do with it, and what happens after a cyber incident.

This guide walks through DFARS subpart 239.76 and the two DFARS texts that go with it: the 252.239-7009 representation in the solicitation and the 252.239-7010 clause in the contract. It also covers how the clause differs from DFARS 252.204-7012, the safeguarding clause most defense contractors already know. It is written for founders, security leads and the people who answer DoW security questionnaires at a software company, and it builds on our guides to the authority to operate and the FedRAMP 20x timeline.

The DFARS text predates the department’s renaming, so the regulation still uses its former name. The rules are the same.

---

Which contracts carry the clause

DFARS 239.7604 prescribes two texts for information technology services, and it says both apply to acquisitions under FAR part 12 commercial procedures too:

• 252.239-7009, Representation of Use of Cloud Computing, goes in the solicitation.
• 252.239-7010, Cloud Computing Services, goes in the solicitation and the contract.

The clause’s definition of cloud computing is the familiar NIST one, on-demand network access to a shared pool of configurable computing resources, and it adds that the term includes commercial offerings for software-as-a-service, infrastructure-as-a-service and platform-as-a-service. There is no commercial-item escape hatch. If you sell a SaaS product to a DoW buyer as an IT service, expect this clause. Our guide to commercial products under FAR part 12 covers what commercial status does and does not change.

The representation

Under 252.239-7009, the offeror checks one of two blanks: it does or does not anticipate that cloud computing services will be used in performance of any contract or subcontract resulting from the solicitation.

That answer matters later. Paragraph (b)(1) of the 7010 clause says that if the contractor represented that it did not anticipate using cloud computing and, after award, proposes to use it, the contractor shall obtain approval from the contracting officer before using cloud computing services in performance. A services company that plans to move delivery onto a SaaS tool partway through a contract should answer the representation with that in mind. Our guide to representations and certifications covers why these answers are statements to the government.

---

Provisional authorization from DISA

The core rule is in DFARS 239.7602-1(b). The contracting officer shall only award a contract to acquire cloud computing services from a cloud service provider that has been granted provisional authorization by the Defense Information Systems Agency (DISA), at the level appropriate to the requirement, under the Cloud Computing Security Requirements Guide (SRG). The SRG version is the one in effect when the solicitation is issued, or as the contracting officer authorizes, and it is published at public.cyber.mil.

Three details are worth reading closely.

• Every tier. The rule names the cloud service provider as a “contractor or subcontractor, regardless of tier”. Selling through a reseller or an integrator does not move the requirement off your product.
• The level. The SRG sorts cloud offerings into impact levels by the sensitivity of the data and mission they support, and the authorization has to match the level the requirement calls for. The SRG also describes how an existing FedRAMP authorization is leveraged toward a provisional authorization. Read the current SRG for the levels and the reciprocity rules rather than relying on a summary.
• Two exceptions. The contracting officer may award to a provider without a provisional authorization when the DoW Chief Information Officer waives the requirement, or when the requirement is for a private, on-premises version provided from U.S. Government facilities. In that second case, the provider must still obtain a provisional authorization before operational use.

A provisional authorization is not the end of the process. It is DISA’s assessment of the offering. The mission owner that uses it still authorizes its own system under the department’s Risk Management Framework, Instruction 8510.01, which is where the “authorizing official” in the clause’s definitions comes from. Our ATO guide covers how agency authorizations work.

Readiness you describe yourself is not a provisional authorization. A buyer asking whether you can be awarded a DoW cloud contract is asking whether DISA has granted one at the right level, not whether your controls look similar.

---

Security controls and where the data lives

Paragraph (b) of the clause sets two baseline duties once cloud computing is used to provide IT services under the contract:

• Controls. The contractor shall implement and maintain administrative, technical and physical safeguards and controls with the security level and services required by the SRG, unless the contracting officer says the DoW Chief Information Officer has waived that requirement.
• Data location. The contractor shall maintain within the United States or outlying areas all Government data that is not physically located on DoW premises, unless it receives written notification from the contracting officer to use another location. DFARS 239.7602-2 spells out the area as the 50 states, the District of Columbia and the outlying areas of the United States.

The data location rule reaches every component that holds the data, including backups, replicas, support tooling and any subprocessor. If your product replicates to a region outside the United States by default, a DoW deployment needs a configuration that does not, or a written notice that permits it.

---

What you may do with the data

Paragraph (c) is the part of the clause most likely to clash with a standard SaaS business model. It separates two kinds of data.

• Government data is any information created or obtained by the government in the course of official business. Paragraph (c)(1) says the contractor shall not access, use or disclose Government data unless specifically authorized by the contract or an order under it, and then only for the purposes the contract specifies. The contractor must bind its employees to those limits, and the limits survive the end of the contract.
• Government-related data is what the contractor creates or obtains by storing, processing or communicating Government data. Logs and metadata generated while serving the Government data are typical examples. It excludes the contractor’s own business records and its operating procedures, code or algorithms that are not uniquely applied to the Government data. Paragraph (c)(2) says the contractor shall use Government-related data only to manage the operational environment that supports the Government data, unless the contracting officer gives prior written approval for another purpose.

Read your product’s standard practices against those two sentences. Product analytics built from customer content, benchmarking across customers, and training or tuning machine learning models on customer data are all uses. Under this clause each one needs a basis in the contract or the contracting officer’s written approval. Our guides to software license terms in federal contracts and data rights cover the other half of the data question, which is what the government may do with yours.

---

Cyber incidents

Paragraphs (d) through (h) set the incident duties for the cloud service.

• Report. The contractor shall report all cyber incidents related to the cloud computing service provided under the contract, through the department’s DIBNet portal at dibnet.dod.mil. The clause defines a cyber incident as actions taken through computer networks that result in a compromise or an actual or potentially adverse effect on an information system or the information in it.
• Malicious software. A contractor or subcontractor that discovers and isolates malicious software in connection with a reported incident submits it as the contracting officer instructs.
• Preserve. The contractor shall preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data for at least 90 days from submission of the incident report, so the department can request the media or decline interest.
• Forensics and damage assessment. On request, the contractor provides access to additional information or equipment needed for forensic analysis, and provides the preserved information if the department decides to conduct a damage assessment.

The 7010 clause does not itself set a reporting clock. The familiar 72-hour window comes from DFARS 252.204-7012, which defines “rapidly report” as within 72 hours of discovery. Check your contract and the SRG for the timeline that applies to your offering, and plan incident response so that preserving 90 days of images and packet capture is possible in your architecture.

---

Records, access and outside requests

Paragraphs (i) through (k) cover the life of the data.

• Records management. The contractor provides all Government data and Government-related data in the format the contract specifies, disposes of it according to the contract, and confirms disposition to the contracting officer at closeout. On the government side, DFARS 239.7602-1(c)(2) tells the requiring activity to write disposition instructions that provide for transition of data in a commercially available, or open and non-proprietary, format. A clean export path is a contract requirement, not a nice-to-have. Our guide to contract closeout covers the end of the contract.
• Audit and facility access. The contractor gives the government or its authorized representatives access to the data, to contractor personnel involved in performance, and physical access to any contractor facility with Government data for audits, investigations and inspections authorized by law or regulation.
• Third-party requests. The contractor shall notify the contracting officer promptly of any third-party request for Government data or Government-related data, including warrants, seizures or subpoenas, even from another federal, state or local agency, and cooperate to protect the data from unauthorized disclosure.
• Spillage. If classified or controlled unclassified information lands on a system not authorized for that level, the contractor cooperates with the contracting officer to address it under agency procedures.

---

Commercial terms still count

DFARS 239.7602-1(a) says the department shall generally acquire cloud computing services using commercial terms and conditions that are consistent with federal law and the agency’s needs. It names license agreements, end user license agreements and terms of service as examples. The contracting officer incorporates the provider’s applicable terms into the contract by attachment or another mechanism, and reviews them with counsel.

That is good news for a SaaS company, with a catch. Your standard terms will be read against federal law and against the 7010 clause, and where they conflict, the terms give way. A data-use provision broader than paragraph (c) allows is the obvious example. Our guide to software license terms in federal contracts covers the provisions agencies cannot accept.

---

Flow-down

Paragraph (l) requires the contractor to include the clause, including paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial services.

So a SaaS company can inherit the clause in two ways: as a prime selling directly, or as a subcontractor or supplier to an integrator whose delivery uses the product. Our guides to flow-down clauses and federal resellers cover how that chain works.

---

7010 or 7012?

Defense contractors often meet DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, first, and it is easy to confuse the two. The 7012 clause draws the line itself.

• You provide a cloud service to the government. Paragraph (b)(1)(i) of 7012 says that for covered systems that are part of an IT service or system operated on behalf of the government, cloud computing services are subject to the security requirements of 252.239-7010. That means the SRG and a DISA provisional authorization.
• You use cloud for your own work on a defense contract. For covered systems that are not operated on behalf of the government, 7012 requires NIST SP 800-171. Paragraph (b)(2)(ii)(D) adds that if the contractor uses an external cloud service provider to store, process or transmit covered defense information, it shall ensure the provider meets security requirements equivalent to the FedRAMP Moderate baseline and complies with the clause’s incident reporting, malicious software, media preservation, forensic access and damage assessment paragraphs.

The second case is how many SaaS companies meet DoW requirements without selling to the department at all: a defense contractor wants to put covered defense information in your product, and asks for FedRAMP Moderate equivalence and incident cooperation in the subcontract. The CMMC program assesses contractors against the same 800-171 requirements. Our guide to CMMC in 2026 covers where that program stands.

---

A checklist for SaaS companies

• Find the texts. Search DoW solicitations for 252.239-7009 and 252.239-7010, and subcontracts from defense primes for 252.239-7010 and 252.204-7012.
• Know which case you are in. Selling a cloud service to the department points to 7010 and a DISA provisional authorization. Holding a defense contractor’s covered defense information points to 7012 and FedRAMP Moderate equivalence.
• Answer the representation deliberately. If you check “does not anticipate”, any later move to cloud delivery needs the contracting officer’s approval first.
• Map your data flows. List every place Government data and Government-related data are stored or processed, including backups, logs, support tools and subprocessors, and confirm each one is in the United States or outlying areas.
• Audit secondary use. Analytics, benchmarking and model training on customer data need a basis in the contract or written approval.
• Rehearse an incident. Confirm you can report through DIBNet, hold 90 days of images and packet capture, and support a forensic request.
• Build the export. Plan to hand back data in an open, non-proprietary format at the end of the contract and to certify disposition.
• Read the current rule text. The FAR and its supplements are being rewritten under the Revolutionary FAR Overhaul, so section numbers and wording may move. This guide reflects the eCFR text read on 2026-11-04. Confirm the clauses in your contract and get advice from counsel on specific situations.

---

The short version

• DFARS 252.239-7010 goes in DoW contracts for IT services, commercial ones included, and it covers SaaS, PaaS and IaaS.
• Contracting officers may only award cloud contracts to providers with a DISA provisional authorization at the right level under the SRG, at every subcontract tier, unless the DoW Chief Information Officer waives it.
• Government data stays in the United States or outlying areas unless the contracting officer permits another location in writing.
• Government data may only be used as the contract authorizes, and Government-related data only to run the environment that supports it.
• All cyber incidents related to the service are reported through DIBNet, with 90 days of images and packet capture preserved.
• The clause flows down to every subcontract that involves or may involve cloud services.

---

Where this fits

DoW buyers ask about authorization, data location and incident handling before they ask about features. It helps to know how your company looks across the categories federal buyers review, verified and self-attested kept apart, before the security questionnaire arrives. Score your company’s federal readiness to see where you stand.

---

Related reading

• Authority to Operate (ATO) for SaaS Companies: What It Is and How Agencies Grant One
• FedRAMP 20x: Timeline, Eligibility, and Cost for SaaS Companies
• CMMC in 2026: Phase I In Force, Phase II Suspended
• Flow-Down Clauses for Software Companies
• Software License Terms in Federal Contracts: What Agencies Can’t Sign