DFARS 252.204-7012 requires reporting a cyber incident within 72 hours of discovery when it affects a covered contractor information system, the covered defense information (CDI) residing there, or the ability to perform operationally critical support designated and identified in the contract. It also requires preserving images of all known affected systems identified in the incident review and all relevant monitoring and packet-capture data for at least 90 days from report submission. The clause also contains a historical 30-day gap-notification provision, but it applies only to contracts awarded before October 1, 2017. It is not a general grace period for current awards.
What the clause is and who it applies to
The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, appears in DoD contracts that involve covered defense information (CDI): unclassified controlled technical information or other information described in the CUI Registry that requires safeguarding and is provided to or collected by the contractor for the contract. It applies on its own terms, whether or not CMMC applies to you, and it flows down to subcontracts that involve CDI or operationally critical support. Read the DFARS 252.204-7012 clause text. Our page on DFARS 252.204-7012 walks through it paragraph by paragraph.
Incident clocks and historical notice at a glance
| Clock | Starts when | Deadline | What the clause requires | Prepare before it starts |
|---|---|---|---|---|
| Historical gap notice: only contracts awarded before October 1, 2017 | Award of a contract before October 1, 2017 | 30 days | Notify the DoD CIO of any NIST SP 800-171 requirement not implemented at award (paragraph (b)(2)(ii)(A)) | A current, honest SSP and POA&M |
| Incident report | You discover a cyber incident affecting a covered system, CDI, or ability to perform operationally critical support designated and identified in the contract | 72 hours | Review for evidence of compromise, report to DoD through DIBNet, and submit malicious software discovered and isolated in connection with a reported incident to the DoD Cyber Crime Center under its or the contracting officer's instructions (paragraphs (c) and (d)) | A DoD-approved medium assurance certificate and a decision process for “is this reportable?” |
| Preservation | You submit the report | At least 90 days | Preserve images of all known affected systems identified in the incident review and all relevant monitoring and packet-capture data; give DoD access for forensics; support the damage assessment (paragraphs (e), (f) and (g)) | The ability to take forensic images on demand, and a place to keep them |
Historical notice: 30 days for contracts awarded before October 1, 2017
Paragraph (b)(2)(ii)(A) limits the 30-day notice to contracts awarded before October 1, 2017. For those awards, contractors had to notify the DoD CIO of NIST SP 800-171 requirements not implemented at award, within 30 days of that award. The paragraph also set a December 31, 2017 implementation deadline. This historical provision does not give current awards a general 30-day disclosure window or permission to leave requirements unmet. Separately, paragraph (b)(2)(ii)(B) provides for written requests to the contracting officer for DoD CIO consideration of a nonapplicable requirement or an alternative, equally effective measure; submitting a request is not approval.
For current readiness planning, maintain a current System Security Plan (SSP) that states how each requirement is met, and a Plan of Action and Milestones (POA&M) that lists what is not. This is separate from the assessment score you post in SPRS under DFARS 252.204-7019; see SSP, POA&M and SPRS and how to calculate your SPRS score.
Incident reporting: 72 hours from discovery to report an incident
A cyber incident, as the clause defines it, is an action taken through the use of computer networks that results in a compromise or an actual or potentially adverse effect on an information system or the information in it. Under paragraph (c), when you discover one that affects a covered contractor information system, the CDI on it, or your ability to perform operationally critical support designated and identified in the contract, you must review for evidence of compromise (including which computers, servers, data and user accounts are affected) and rapidly report it to DoD through DIBNet, within 72 hours of discovery. Under paragraph (d), malicious software discovered and isolated in connection with a reported incident must be submitted to the DoD Cyber Crime Center (DC3) in accordance with DC3 or contracting officer instructions.
The report requires a DoD-approved medium assurance certificate. Identity verification takes time, so a contractor who starts the process during an incident has already used part of the window. Things to put in place now:
- The certificate, held by a named person, with a backup person.
- A short triage question: does this affect a covered system, CDI, or the ability to perform operationally critical support designated and identified in the contract?
- A named decision-maker and a contact list that works outside business hours.
- An incident procedure with a step for capturing malware samples instead of deleting them.
Preservation: at least 90 days of preserved evidence
Paragraph (e) requires you to preserve and protect images of all known affected information systems identified in the paragraph (c)(1)(i) review and all relevant monitoring and packet-capture data for at least 90 days from the submission of the report, so that DoD can request them. Paragraph (f) lets DoD ask for access to additional information or equipment for forensic analysis, and paragraph (g) requires you to support a damage assessment.
This is a capability question, not a policy one. Most environments cannot produce a forensic image of an endpoint on demand. Decide in advance how images are taken, where they are kept and who can retrieve them. The damage assessment also depends on knowing, before anything goes wrong, where CDI lives and which systems touch it. That is a boundary question; see CUI boundary definition.
How do the clocks reach subcontractors and cloud providers?
Subcontractors. Paragraph (m) requires the clause, without alteration, in subcontracts involving CDI or operationally critical support. A subcontractor that reports directly to DoD gives the DoD-assigned incident report number to the prime as soon as practicable. Your suppliers' incidents have to reach you in time for you to meet your own obligations.
Cloud providers. Paragraph (b)(2)(ii)(D) requires an external cloud service provider that stores, processes or transmits CDI to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with the incident reporting, malware, media preservation and damage assessment paragraphs. In practice that is what pushes some contractors toward a government cloud tenant or a purpose-built enclave; see PreVeil enclave for CMMC.
Where do contractors get caught?
- Waiting to get the certificate until an incident. It cannot be obtained inside the 72-hour window.
- Treating preservation as a policy statement. Without a way to image systems, the sentence in the policy cannot be carried out.
- Not knowing where CDI lives. You cannot scope an incident or a damage assessment around data you cannot locate.
- Forgetting suppliers. Flow-down makes a supplier's posture part of your compliance position.
- Treating 7012 and CMMC as one thing. 7012 sets the obligations. CMMC, through DFARS 252.204-7021, adds a required assessment. See CMMC Level 2 in plain English.
Common questions
Does DFARS 252.204-7012 apply to my company?
It applies if your contract includes the clause, which DoD uses in contracts involving covered defense information, and it must be flowed down to subcontracts that involve that information or operationally critical support. Check your contract and any flow-down from your prime. The clause is separate from CMMC.
What counts as a reportable cyber incident under DFARS 7012?
The clause defines a cyber incident as actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system or the information residing in it. Reporting is required when the incident affects a covered contractor information system, the covered defense information on it, or your ability to perform operationally critical support designated and identified in the contract. If you are unsure, treat the decision as urgent and involve counsel and your contracting officer.
Do I need a medium assurance certificate before I have an incident?
You need one to submit a report through DIBNet, and the 72-hour window starts at discovery, not when you obtain the certificate. Contractors that handle covered defense information should obtain one in advance and keep it current.
How is DFARS 7012 different from CMMC?
DFARS 252.204-7012 sets the obligations: implement NIST SP 800-171, report cyber incidents, preserve evidence and flow the clause down. CMMC, required through DFARS 252.204-7021 and codified in 32 CFR Part 170, adds a required assessment to show you meet NIST SP 800-171.
What if I cannot meet a NIST SP 800-171 requirement on day one?
The 30-day notice in paragraph (b)(2)(ii)(A) applies only to contracts awarded before October 1, 2017; it is not a general grace period for current awards. Paragraph (b)(2)(ii)(B) separately allows written requests through the contracting officer for DoD CIO consideration of a nonapplicable requirement or an alternative, equally effective measure. A request or a POA&M does not itself authorize noncompliance.
Primary sources
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov)
- NIST SP 800-171 Revision 2 (NIST CSRC)
- National Archives CUI program and Registry
- 32 CFR Part 170: Cybersecurity Maturity Model Certification Program (eCFR)
The contract you hold, and any class deviations that apply to it, control which version of each requirement applies to you. If you want help preparing for incident reporting and evidence preservation, send us a message.