A Cyber Incident Starts a 72-Hour Clock: What DFARS 7012 Requires

CUI comes through the contract, and so does DFARS 252.204-7012. Most of the attention goes to its NIST SP 800-171 requirement. The incident reporting rules in the same clause matter just as much on a bad day, and some steps can't wait until then.

What the clause requires

When you discover a cyber incident that affects a covered contractor information system or the covered defense information on it, DFARS 252.204-7012(c)–(e) requires you to:

• Review for evidence of compromise of covered defense information, including compromised computers, servers, specific data and user accounts- Rapidly report the incident to DoD at https://dibnet.dod.mil. "Rapidly report" means within 72 hours of discovery.- Submit malicious software you discover and isolate to the DoD Cyber Crime Center (DC3)- Preserve and protect images of all known affected systems and relevant monitoring and packet capture data for at least 90 days from the report, so DoD can request themSubcontractors report directly to DoD and give their prime (or next higher-tier subcontractor) the incident report number DoD assigns. ## What to have before day one
• A DoD-approved medium assurance certificate. The clause requires one to report. Certificates come through DoD's External Certification Authority (ECA) program.- The facts the report asks for. DC3's reporting guidance lists items such as your UEI, CAGE codes, contract numbers, contracting officer and program manager contacts, and a description of what happened.- An incident plan that names who decides an incident is reportable, who files the report and who tells your prime.- Logging and backups that let you preserve images and show what was touched.## Start here Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida. We help you get your incident plan and reporting details ready before you need them: https://cyberneza.com/contact Sources: DFARS 252.204-7012, DC3 DIB Support and Resources