Guides DFARS and FAR

DFARS 7012 cyber incident reporting: the 72-hour rule

DFARS 252.204-7012 requires a cyber incident report to DoD through DIBNet within 72 hours of discovery, a medium assurance certificate and 90 days of evidence.

By Chris Edwards, Edwards Consulting Group · Updated October 21, 2026

Under DFARS 252.204-7012, a contractor that discovers a cyber incident affecting a covered contractor information system, the covered defense information on it, or its ability to provide operationally critical support must report it to DoD at dibnet.dod.mil within 72 hours of discovery, using a DoD-approved medium assurance certificate. Malicious software goes to the DoD Cyber Crime Center (DC3), images of the affected systems are kept for at least 90 days, and a subcontractor passes its DoD-assigned incident report number up to its prime.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

Which version of the clause applies

Two texts of DFARS 252.204-7012 are in use: the codified clause on acquisition.gov, dated MAY 2024, and the "(JUN 2026) (DEVIATION 2026-O0025)" version in the DFARS Part 240 attachment to Class Deviation 2026-O0025 (Revision 3, September 3, 2026, on the DPCAP page), which DoD contracting officers have used since February 1, 2026. We compared them sentence by sentence: paragraphs (c) through (g) and (m) are identical, and the deviation differs only in (b)(2)(i), which names NIST SP 800-171 "Revision 2", and in the paragraph (a) definition of "technical information", which cites 252.227-7989 rather than 252.227-7013. The quotes below are from the codified text and hold for both. See DFARS and FAR cybersecurity clauses, as of 2026.

What counts as a cyber incident

The clause defines its terms in paragraph (a):

Cyber incident "means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein."
Covered contractor information system "means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information."
Covered defense information means unclassified controlled technical information or other CUI Registry information "that requires safeguarding or dissemination controls", either marked and provided by or for DoD under the contract or "Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract."
Rapidly report "means within 72 hours of discovery of any cyber incident."

The definition of cyber incident does not require proof that data left: an "actual or potentially adverse effect" is enough.

When the 72 hours start

Paragraph (c)(1) sets the trigger: "When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract". The clock runs from discovery, not from the end of the investigation.

Two duties follow. Under (c)(1)(i), "Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts", on the affected systems and on "other information systems on the Contractor's network(s), that may have been accessed as a result of the incident". Under (c)(1)(ii), "Rapidly report cyber incidents to DoD at https://dibnet.dod.mil."

The review and the report run together: DC3's page says to "report as much of the following information as can be obtained within 72 hours" and that later facts go in "a follow-on ICF". A first report with gaps beats a complete report on day four.

How to report a cyber incident to DoD

Where. The clause names dibnet.dod.mil. On October 21, 2026 that address redirected to DC3's DIB Cybersecurity DCISE page, which carries the "Report a Cyber Incident" link. DC3 calls DCISE "the single focal point and data repository for DIB cyber incident reporting required by 10 U.S. Code Sections 391 and 393 and DFARS 252.204-7012"; reports go through "the DCISE Incident Collection Format portal".

What goes in it. Under (c)(2), "The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements at https://dibnet.dod.mil." DC3's page lists those elements: among them company name, UEI and facility CAGE code; the contract number (PIID), contracting officer and points of contact; "Impact to Covered Defense Information"; "Ability to provide operationally critical support"; the date discovered and location of compromise; the programs, platforms or systems involved; the type, technique and outcome of the compromise; and a narrative.

The certificate. Under (c)(3), "the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents." DC3 says the certificate is "required to access the secure reporting portal" and that approved External Certification Authority (ECA) vendors "include IdenTrust and WidePoint". Get one before an incident, not during one.

No certificate yet. DC3's page: "if you do not yet have a DoW-approved Medium Assurance Certificate and need to report a cyber incident, please email DC3.DCISE@us.af.mil or call the DCISE hotline at (410) 981-0104 for further assistance." The hotline "operates 24/7".

Who reports. DC3's FAQ answers whether a prime can file for a supplier: "No. DFARS 252.204-7012 requires the impacted company to submit a report on the specific cyber incident."

Malicious software goes to DC3

Paragraph (d): "When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer."

DC3's instructions: with a PKI certificate you can get an Electronic Malware Submission (EMS) portal account; otherwise "request a one-time link for uploading malware by emailing DC3.DCISE@us.af.mil and including your ICF number in the subject line, or by calling (410) 981-0104." And: "DO NOT use email to submit malicious files to DoW."

Keep the evidence for 90 days

Three paragraphs cover what happens after the report:

(e) Media preservation and protection. The contractor "shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest."
(f) Access. "Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis."
(g) Damage assessment. "If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause."

The 90 days run from submission, so a late report also delays the day you may wipe and rebuild.

What a report does not mean

The deviated DFARS Part 240 text, at 240.370-3(d), tells contracting officers that a reported incident "must not, by itself, be interpreted as evidence that the contractor or subcontractor has failed to provide adequate security on their covered contractor information systems". Reporting is the duty; not reporting is the breach.

Subcontractors: flowdown and the report number

Under (m)(1), the prime must "Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties."

Under (m)(2)(ii), the prime must require subcontractors to "Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD as required in paragraph (c) of this clause."

So a subcontractor reports to DoD itself, with its own certificate, and tells its prime the report number; the clause does not make it send the prime the report. What a prime can ask suppliers about incident readiness is in How primes check their suppliers' cybersecurity.

One more party is bound: under (b)(2)(ii)(D), an external cloud service provider holding covered defense information must comply "with requirements in paragraphs (c) through (g) of this clause", so your cloud contract has to let you meet the 72 hours and the 90 days.

A 72-hour checklist

Record the discovery time. The clock runs from it.
Confirm the certificate holder can reach the DCISE portal; with no certificate, call the hotline.
Start the (c)(1)(i) review of computers, servers, data and accounts, on the affected systems and any reached from them.
File the report with what is known inside 72 hours; file a follow-on when more is known.
Submit any isolated malicious software to DC3 through EMS or a requested link, never by email.
Image the affected systems and keep monitoring and packet capture data for 90 days from submission.
As a subcontractor, send the DoD report number to your prime as soon as practicable.

Where Tiermark fits

Tiermark's attestation campaigns send each supplier a DFARS 252.204-7012 baseline questionnaire whose "Incident reporting" section asks whether the supplier can discover, report to DoD through DIBNet and preserve evidence of a cyber incident within 72 hours, whether it holds a DoD-approved medium assurance certificate for DIBNet reporting, and whether any cyber incident affecting CDI occurred in the past twelve months and, if so, whether and when it was reported. Answers come back signed and cannot be edited afterwards. Tiermark does not file reports, hold certificates or read DIBNet.

Sources

Still have a question?

Write to help@tiermark.io and a person will answer.