What Is the 72-Hour Incident Reporting Rule?

You discover a possible intrusion on a system that holds defense information, and the clock is already running. DFARS 252.204-7012 says you must rapidly report cyber incidents to DoD. DFARS stands for the Defense Federal Acquisition Regulation Supplement. DoD is the Department of Defense. Rapidly report means within 72 hours of discovery of any cyber incident. (DFARS 252.204-7012(a))

What counts as a reportable incident

The clause defines a cyber incident as actions through computer networks that compromise a system or adversely affect it. CDI means Covered Defense Information, the unclassified information DoD gives you or that you create under the contract. A covered contractor information system is the system that processes, stores, or transmits that information. An incident affecting such a system, the CDI in it, or contract-designated operationally critical support must be reported. Do not wait for full confirmation before reporting. (DFARS 252.204-7012(c))

How to file the report

The report goes to DoD at https://dibnet.dod.mil. The report must include the required elements listed on that site. You need a DoD-approved medium assurance certificate to file, so obtain one before an incident happens. The certificate application process is described at public.cyber.mil/eca.

What to do, in order

1. Discover and record the time of discovery. The 72-hour clock starts there.
2. Contain the affected system, but do not wipe it. Evidence must survive.
3. Conduct the required review for compromised computers, servers, data, and user accounts.
4. File the incident report through dibnet within 72 hours.
5. Preserve images of affected systems and packet capture data for at least 90 days after filing.
6. Submit any isolated malicious software to the DoD Cyber Crime Center, not to the contracting officer.
7. If you are a subcontractor, pass the DoD-assigned report number up the chain as soon as practicable.

The contractor files the report directly with DoD. Subcontractors pass the DoD-assigned report number up the chain. The clause flows down without alteration to subcontracts involving CDI or operationally critical support. (DFARS 252.204-7012(m))

The biggest mistake is preparing the certificate during the incident. Get the certificate, assign who reports, and rehearse the review steps now. PolicyCortex reads live Azure configuration for incident-relevant evidence and maps findings to NIST 800-171 controls: PolicyCortex.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024): https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
• DoD DIBNet, cyber incident reporting portal: https://dibnet.dod.mil
• DoD External Certification Authority, medium assurance certificates: https://public.cyber.mil/eca/