A software company’s defense contracts do not automatically mean its commercial product is subject to DoD requirements—or that a commercial customer may use it for sensitive government data. Before buying, check what information your use will involve, whether it supports a government contract, which service environment you are buying, and what the contract and product terms actually require.
This checklist focuses on U.S. Department of Defense acquisitions. It can help identify questions for a vendor, contracting officer, or counsel; it cannot determine your obligations without the solicitation, contract, data classification, and applicable flow-down clauses.
1. Identify the data and what you will use the software to do
Start with the intended use, not the vendor’s customer list. Ask whether the service will receive government data or information connected to contract performance, and whether that information is Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or covered defense information. Do not classify data based only on who sells the software or who else buys it.
DFARS defines covered defense information with reference to information that requires safeguarding or dissemination controls and its connection to contract performance. FCI is information not intended for public release that is provided by or generated for the government under a contract, subject to specified exclusions. The definitions and related requirements appear in DFARS Part 204.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Which data fields, files, prompts, attachments, logs, or support records will enter the product?
- Will the software be used to perform a specific government contract, or only for a separate commercial purpose?
- Has the contracting officer, security lead, or other responsible authority identified the information category and applicable clauses?
2. Confirm the exact product, environment, and authorization
Ask the vendor to identify the precise service and deployment model in scope: for example, a standard commercial tenant, a government cloud environment, or an on-premises installation. These are not interchangeable. A company-level certification or a general statement that it serves government customers does not show that the specific service, tenant, region, or configuration is covered.
For a relevant DoD cloud acquisition, DFARS generally calls for the cloud service provider to have a DISA provisional authorization at the level appropriate to the requirement. The regulation describes exceptions for a waiver by the DoD CIO and for a private, on-premises version provided from U.S. Government facilities; in the latter case, authorization is required before operational use. Review the applicable terms in DFARS Part 239.
- Request evidence tied to the exact service name, environment, scope, and authorization level—not just a corporate overview.
- Confirm which parts of the service are covered, including any integrations or subprocessors that handle the data.
- Ask whether the offered environment is the same one authorized for the intended data and contract use.
3. Check where data goes and how you can get it back
For relevant cloud acquisitions, DFARS addresses descriptions of government and government-related data, ownership and licensing instructions, delivery and disposition, transition to another service, and support for authorized audits and investigations. It generally requires government data held outside DoD premises to remain in the 50 states, the District of Columbia, or U.S. outlying areas unless an authorizing official permits otherwise. These requirements depend on the acquisition and applicable contract terms.
Rank #2
Ask the vendor to explain the full data lifecycle, not only the location of the primary database:
- Where data is stored and processed, including backups, telemetry, and support systems.
- Where subprocessors operate and what data they can access.
- How exports work, which commercially available or open non-proprietary formats are supported, and whether export includes metadata and attachments.
- What deletion means at account closure, how long backups persist, and whether deletion can be confirmed.
- What transition assistance is available and whether the contract adds requirements for delivery, retention, or disposition.
Use the data and location provisions in DFARS Part 239 as prompts for contract-specific review rather than assuming every commercial service is subject to identical terms.
4. Understand security duties and incident cooperation
Applicable DFARS clauses can require adequate security for covered contractor information systems and rapid reporting of cyber incidents. In DFARS 204.7301, “rapidly report” means within 72 hours of discovery of a cyber incident. That is a timing definition in the applicable DoD clause context, not a universal breach-notification deadline for every software customer.
Rank #3
DFARS 252.204-7012 also addresses external cloud service providers used to store, process, or transmit covered defense information in contract performance. The clause text describes requirements equivalent to the FedRAMP Moderate baseline and terms concerning incident reporting, preservation of media, access, and forensic cooperation. Whether those obligations apply depends on the use and contract. Consult the current clause in your contract and the official DFARS Part 204 materials.
- What security responsibilities belong to your organization, the vendor, and any subcontractors?
- How and when will the vendor notify you of an incident affecting your data?
- Will it preserve relevant media and cooperate with authorized investigation and forensic requests?
- Does the evidence cover the exact environment and system handling your information?
5. Determine whether CMMC applies to the systems in your use
Do not assume that every software purchase triggers a Cybersecurity Maturity Model Certification (CMMC) requirement. When applicable, the solicitation specifies the required level. DFARS provides that systems used in contract performance that process, store, or transmit FCI or CUI must have the specified or higher status at award and maintain it when the contract requires. Check the solicitation and applicable clauses, then verify status for the systems and identifiers relevant to the proposed use in the official system.
A vendor’s broad claim that it is “CMMC compliant” is not enough to establish that the relevant system has the required, current status. Ask which system boundary and identifiers the status covers and whether they match the service environment you will use. The governing context is in DFARS Part 204.
Rank #4
6. Read the license, service terms, and software-rights provisions
Review the actual end-user license agreement, terms of service, and contract terms. DFARS calls for careful review of applicable commercial terms. As the regulation puts it, “Contracting officers shall carefully review commercial terms and conditions and consult counsel to ensure these are consistent with Federal law, regulation, and the agency’s needs.” See DFARS 239.7602-1(a).
Software rights depend on the software category and the contract; rights provisions distinguish commercial software from other-than-commercial software. A vendor’s defense contract does not, by itself, grant you rights or change the terms of a commercial license. Review the applicable rights provisions in DFARS Part 227 alongside your own agreement.
- What rights do you receive to use, copy, configure, or retain the software and its outputs?
- May the vendor use customer prompts, files, or other inputs to improve or train services?
- What do subcontractor terms permit, and do confidentiality protections extend through the supply chain?
- What happens to data, access, and licenses at termination?
- Do audit, confidentiality, and disclosure terms fit the intended government use?
7. Compare vendors on the same basis
When evaluating multiple providers, compare the same deployment model and intended data use. A standard commercial tenant should not be treated as equivalent to a government cloud environment or an on-premises offering simply because the vendor sells all three.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Comparison area | What to establish |
|---|---|
| Service and authorization scope | Exact product, environment, authorization evidence, and covered system boundaries. |
| Data use | Accepted data categories, customer-input use, training, and other secondary uses. |
| Location and subprocessors | Storage and processing locations, backup location, and subprocessor access. |
| Export and deletion | Transition format, export scope, deletion process, and backup retention. |
| Incident response | Notification terms, media preservation, investigation access, and forensic cooperation. |
| Contract security requirements | Applicable clauses, evidence for the relevant system, and whether CMMC applies. |
| Legal and commercial terms | License rights, ownership, confidentiality, audits, subcontractors, and termination. |
Map each answer to your intended use and contract. If the vendor cannot connect a claim to the precise service and system handling your data, treat the claim as unverified for that use.
When to get contract-specific advice
DFARS is U.S. DoD acquisition regulation, and its requirements are most relevant when software is acquired for or used in contract performance involving government information. A buyer’s exact duties cannot be determined from the vendor’s defense work or a marketing claim alone. Have the contracting officer or counsel resolve uncertainty about data classification, solicitation language, clauses, flow-downs, and whether a particular service environment satisfies the requirement. Regulatory language and clause applicability can change; rely on the current text tied to the contract.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
