DFARS 7012 Sets a 72-Hour Reporting Window for Defense Contractor Cyber Incidents

Under DFARS 252.204-7012, contractors who discover a cyber incident affecting covered defense information must review for evidence of compromise and report it to DoD within 72 hours of discovery. Malicious software that is found and isolated must be submitted to the DoD Cyber Crime Center, and images of affected systems plus relevant monitoring data must be preserved for at least 90 days. Subcontractors report directly to DoD and pass the assigned incident report number to their prime contractor or higher-tier subcontractor. The article advises contractors to prepare in advance by obtaining a DoD-approved medium assurance certificate, gathering required reporting details, and establishing an incident plan and adequate logging.