What Is the DFARS 72-Hour Cyber Incident Reporting Rule?

Defense contractors that hold covered defense information must report cyber incidents to DoD within 72 hours of discovery. The rule is the DFARS clause at 48 CFR 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024). The clause defines rapidly report as within 72 hours of discovery of any cyber incident.

What counts as a cyber incident. A cyber incident is an action taken through computer networks that results in a compromise, or an actual or potentially adverse effect, on an information system or the information in it. The reporting duty applies when the incident affects a covered contractor information system or the covered defense information on it, or affects the contractor's ability to perform operationally critical support identified in the contract.

Steps after discovery. Under paragraph (c), the contractor must:

• Review for evidence of compromise of covered defense information, including compromised computers, servers, data and user accounts, and other systems on the network that may have been accessed.
• Rapidly report the incident to DoD at dibnet.dod.mil.
• Hold a DoD-approved medium assurance certificate to submit the report.

Malicious software. If the contractor finds and isolates malicious software tied to the incident, it submits the software to the DoD Cyber Crime Center (DC3), not to the contracting officer (paragraph (d)).

Preservation and access. The contractor must preserve images of known affected systems and relevant monitoring and packet capture data for at least 90 days from the report, so DoD can request the media or decline interest (paragraph (e)). On request, the contractor gives DoD access to information or equipment needed for forensic analysis (paragraph (f)). If DoD conducts a damage assessment, the contracting officer requests the needed information.

Subcontractors. The prime contractor must include the clause in subcontracts for operationally critical support or that involve covered defense information, including commercial subcontracts. Subcontractors report incidents directly to DoD and give the DoD-assigned incident report number to the prime or next higher-tier subcontractor as soon as practicable (paragraph (m)).

Security baseline. The same clause requires adequate security, including NIST SP 800-171 for covered contractor systems not operated for the government. Contractors required to implement NIST SP 800-171 need a current Basic NIST SP 800-171 DoD Assessment, not more than 3 years old unless the solicitation specifies a shorter period, at award (DFARS 204.7302). CMMC assessments under 32 CFR Part 170 build on these requirements, and the FAQ on CMMC requirements for defense contractors covers that program.

Other reporting rules. Contractors may face separate reporting duties under other contracts or laws, and the clause does not replace them. Incident response plans and staff training on reporting steps help meet the 72-hour window, as covered in compliance training. The Learn Laws® news item on DoD regulatory priorities covers related cybersecurity rules.