Cybersecurity rules in this supplement
AFARS supplements the DoD-wide DFARS cyber rules for the Army:
AFARS Subpart 5104.73 — Safeguarding Covered Defense Information and Cyber Incident Reporting. Implements DFARS Subpart 204.73 for Army acquisitions.
AFARS Subpart 5139.76 and Subsection 5111.106 — Cloud Computing requirements. Add Army-specific cloud-computing policy and requirements.
In plain terms
The Army applies the full DoD defense cyber rulebook — NIST SP 800-171, SPRS scores, and CMMC — and adds its own cloud-computing requirements for systems used on Army work.
Who it applies to
Army contractors and subcontractors handling Federal Contract Information or Covered Defense Information.
What it requires
Everything in the DoD/DFARS cyber baseline (NIST SP 800-171 Rev 2, SPRS, CMMC, 72-hour incident reporting), plus Army cloud-computing requirements.
Why it matters
Army awards apply the DoD cyber regime plus service-specific cloud rules, so both layers must be met.
Citation
Army Federal Acquisition Regulation Supplement (AFARS); see also DFARS at 48 C.F.R. Chapter 2.