When does the 72-hour clock start?

It starts at discovery of the cyber incident, not when your investigation ends. The report goes to DoD through DIBNet, and you can file with the facts you have and add to it later. Hours include weekends and holidays. Check how your contract applies it with your contracting officer or counsel.

What do we need before we can file a report?

A DoD-approved medium assurance certificate, which is needed to use DIBNet. It takes time to obtain because identity checks are part of issuing it, so get it before an incident. Also decide who files and who backs them up.

Where do we send malware we find?

Malicious software that you isolate goes to the DoD Cyber Crime Center (DC3), following DC3 or contracting officer instructions. The clause says not to send it to the contracting officer. Isolate it safely and wait for delivery instructions.

Does this apply to subcontractors, and how long do we keep images?

Yes, the clause flows down to subcontracts that involve covered defense information, and a subcontractor gives its prime the DoD-assigned report number as soon as practicable. Images of affected systems and relevant monitoring and packet-capture data must be kept for at least 90 days from submission of the report. Confirm details with your contracting officer or counsel.

DFARS 7012 Incident Reporting: 72 Hours, DIBNet

Key takeaways

The clause defines "rapidly report" as within 72 hours of discovery of any cyber incident. The report goes to DoD through the DIBNet portal.
To file, the contractor or subcontractor needs a DoD-approved medium assurance certificate. Getting one takes time, so it is a task for a quiet week, not for the incident.
Malicious software you find and isolate goes to the DoD Cyber Crime Center (DC3) under their instructions or the contracting officer's. The clause says not to send it to the contracting officer.
You must preserve images of the affected systems and relevant monitoring and packet-capture data for at least 90 days from the day you submit the report, so DoD can request the media or decline interest.
On request, you give DoD access to additional information or equipment needed for forensic analysis.
A subcontractor passes the DoD-assigned incident report number up to its prime as soon as practicable. The clause flows down to subcontracts that involve covered defense information.

When the clause applies

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is a contract clause. It applies to you if it is in your contract or subcontract, which it is when the work involves covered defense information (CDI) or is designated operationally critical support. CDI is, in plain terms, certain unclassified technical or other sensitive information that the contract marks or that you collect or create for the government, such as drawings, specifications and test data. The clause's rules for your own network are separate (it points to NIST SP 800-171). This article covers only what happens after you discover an incident.

A cyber incident, in the clause's wording, is not limited to a confirmed theft of data. It includes actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system or the information in it. The clause asks you to report incidents that affect a covered contractor information system or the CDI on it, or that affect your ability to perform work designated as operationally critical support.

Step 1: review for evidence of compromise

Paragraph (c)(1)(i) tells you to conduct a review for evidence of compromise of CDI. The review is not just the first computer you noticed. The clause lists identifying compromised computers, servers, specific data and user accounts, and analyzing the systems that were part of the incident and other systems on your network that may have been accessed as a result. That is a scoping exercise: which accounts were used, where did they go next, and what data sat on those systems.

Step 2: report within 72 hours

The clause says to rapidly report cyber incidents to DoD through DIBNet, and the definition of "rapidly report" is within 72 hours of discovery. The clock runs from discovery, not from the end of your investigation. A report with the facts you have, filed on time, is what the clause contemplates; you can supplement it as the review continues. The report is treated as information created by or for DoD and must include, at a minimum, the required elements listed on the DIBNet site, so read that form before you need it.

Two practical points. First, the 72 hours are clock hours, including weekends and holidays. Second, the person who discovers the problem and the person who can file are often different people, so write down who files, who backs them up, and how they are reached at night.

The medium assurance certificate

To report, the contractor or subcontractor must have or acquire a DoD-approved medium assurance certificate. The clause points to the External Certification Authority (ECA) program for how to get one. Identity checks are part of issuing these certificates, which is why they cannot be bought in an hour on the day of an incident. Treat it like a fire extinguisher: obtain it now, record who holds it and when it expires, and test the login once.

Step 3: send malicious software to DC3, not to the contracting officer

If you discover and isolate malicious software connected to the reported incident, paragraph (d) says to submit it to the DoD Cyber Crime Center (DC3) following the instructions provided by DC3 or the contracting officer. It says plainly not to send it to the contracting officer. Isolate the sample safely first (for example, in a password-protected archive handled by the person doing the forensics) and wait for the delivery instructions rather than emailing it around.

Step 4: preserve images and logs for 90 days

Paragraph (e) requires you to preserve and protect images of all known affected information systems identified in your review, and all relevant monitoring and packet-capture data, for at least 90 days from the submission of the cyber incident report. The purpose, in the clause's words, is to allow DoD to request the media or decline interest. The 90 days start at submission, not at discovery.

This is where recovery pressure collides with the clause. Wiping and re-imaging machines to get back to work destroys the evidence. Take a forensic image first, store it read-only with a hash recorded, and keep the relevant log and network-capture data past the usual rotation. If your log retention is 30 days, extend it for this incident before the oldest days age out.

Step 5: give DoD access if it asks

Paragraph (f) says that on DoD's request you provide access to additional information or equipment necessary to conduct a forensic analysis. If DoD elects to do a damage assessment, the contracting officer asks you for the information you preserved under paragraph (e). Decide ahead of time who answers those requests and where the images are kept.

What DoD does with what you send

The clause has protections: the government must protect against unauthorized use or release of contractor attributional or proprietary information obtained under the clause, and you should mark such information as far as practicable. It also lists the limited groups the information may be released to, such as entities that may be called on to help diagnose or mitigate incidents, counterintelligence and law enforcement, and national security and situational-awareness purposes. Read paragraphs (h) through (j) with your counsel.

If you are a subcontractor

The clause must be included, without change except to identify the parties, in subcontracts for operationally critical support or where performance involves CDI. A subcontractor that reports an incident to DoD must give the incident report number, which DoD assigns automatically, to its prime (or the next higher-tier subcontractor) as soon as practicable. Agree with your prime in advance how that handoff happens.

A one-page readiness list

Name the people who can file in DIBNet and hold current medium assurance certificates.
Write the discovery trigger: who decides that an event is a cyber incident under the clause, and how fast.
Keep a map of which systems hold CDI so the paragraph (c) review has a starting point.
Pre-arrange forensic imaging and a place to keep images read-only for at least 90 days.
Set log and packet-capture retention to be extendable on demand.
Rehearse the call chain once a year, including the prime's contact for the report number.
Keep this separate from, and in addition to, any other reporting you owe, such as state breach laws or customer contracts.

We can help you build this plan and run a tabletop rehearsal as scoped, authorized work, and we support the forensic imaging and evidence handling. We do not file on your behalf as a government contact or give legal advice; your contract and your counsel decide what the clause requires of you.

Sources

This article is general information, not legal advice. Whether and how the clause applies depends on your contract. Read the clause version in your contract and confirm the current DIBNet requirements with your contracting officer, prime or counsel. Last reviewed November 9, 2026.

Next · RegulationNIST SP 800-171 Rev. 2 vs Rev. 3 for Contractors: What Changed and Which One You Are Held ToNIST has published a third revision of the standard that defense and federal contractors protect controlled information with, but the requirement your contract or CMMC assessment uses may still be the second. Here is the difference, in plain terms, and how to avoid doing work twice.7 min read

DFARS 252.204-7012 Cyber Incident Reporting: A Walkthrough of the 72‑Hour Clock, DIBNet and the 90‑Day Preservation Rule