List every external system that stores, processes, or transmits your CDI. Include cloud providers, managed service providers, and outsourced IT shops. If a vendor runs it for you, it is in scope. Name each external system in your System Security Plan (SSP). An SSP is the document that records how you meet each safeguard. Vendors left out of the plan are the gap the BAE incident exposes. Check FedRAMP Moderate equivalence for every external cloud provider touching CDI. Get the evidence in writing. The clause says require and ensure, so a verbal promise is not enough. Put a written notice commitment in each vendor contract. Your vendor must tell you about incidents quickly, well before your 72-hour clock runs out. Confirm your forensic cooperation path. DoD can request access to additional information or equipment for forensic analysis. Make sure your vendor contracts let you grant it. ( DFARS 252.204-7012(f) )

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024) Reuters: US federal bankruptcy court operations disrupted by cybersecurity incident (Oct 16, 2026) Cybernews: US bankruptcy court cyberattack disrupts 18 states so far (updated Oct 19, 2026) CyberScoop (via National Cyber Security): Cybersecurity incident at BAE Systems disrupts US bankruptcy court system (Oct 17, 2026)

Guides / October 19, 2026

Your Vendor Was Breached, Not You. Do You Still Owe DoD a Report?

Your systems look fine, but the company running them got breached. You still owe DoD the report.

What happened at BAE Systems?

On October 15, 2026, the Administrative Office of the U.S. Courts (AOUSC) disclosed a cybersecurity incident at BAE Systems, Inc. AOUSC is the administrative agency of the federal courts. BAE operated the Bankruptcy Noticing Center (BNC) on the courts' behalf. The BNC produces and transmits bankruptcy notices for every federal bankruptcy court in the country. All access to the BNC systems and websites BAE operates went dark. That included bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. Notice production had already stopped on October 9. By October 16, courts in 18 states and Puerto Rico had posted disruption notices. A BAE spokesperson said the incident was isolated to the BNC system. No cause was named, and no restoration date was given. (Reuters; Cybernews)

BAE's BNC contract was with the judiciary, not DoD. But the pattern is exactly what the DFARS clause anticipates for defense contracts. DoD is the Department of Defense. DFARS is the Defense Federal Acquisition Regulation Supplement.

Why is a vendor's breach your reporting duty?

Because the clause reaches past your own network. DFARS 252.204-7012 defines a "covered contractor information system" as a system that processes, stores, or transmits covered defense information. The system only needs to be owned, or operated by or for, the contractor. Covered defense information (CDI) is unclassified information that needs safeguarding controls under law or regulation. A vendor running systems for you qualifies.

The reporting duty sits in paragraph (c). The contractor must rapidly report a cyber incident that hits a covered contractor information system. The same duty covers incidents that hit the CDI in it. The report goes to dibnet.dod.mil. Rapidly report means within 72 hours of discovery. The clock starts when you learn of the incident, not when the vendor finishes its investigation. (DFARS 252.204-7012(a), (c))

What must your subcontractors do when they get hit?

The clause writes this chain into the contract for you. Paragraph (m) puts the whole clause into every subcontract that involves covered defense information. Subcontractors report cyber incidents to DoD themselves through dibnet. They must give the DoD-assigned incident report number to the prime contractor as soon as practicable. The prime learns the number every time, and stays responsible for the overall picture. (DFARS 252.204-7012(m))

What does the clause demand from external cloud providers?

Paragraph (b)(2)(ii)(D) covers outside cloud providers. Do you use an external cloud provider to store, process, or transmit CDI? It must meet security requirements equivalent to the FedRAMP Moderate baseline. FedRAMP is the federal cloud authorization program. The provider must also follow the clause's rules. They cover incident reporting, malicious software, media preservation, forensic access, and damage assessment. You must require and ensure this, not just ask. (DFARS 252.204-7012(b)(2)(ii)(D))

What to do this week

List every external system that stores, processes, or transmits your CDI. Include cloud providers, managed service providers, and outsourced IT shops. If a vendor runs it for you, it is in scope.
Name each external system in your System Security Plan (SSP). An SSP is the document that records how you meet each safeguard. Vendors left out of the plan are the gap the BAE incident exposes.
Check FedRAMP Moderate equivalence for every external cloud provider touching CDI. Get the evidence in writing. The clause says require and ensure, so a verbal promise is not enough.
Put a written notice commitment in each vendor contract. Your vendor must tell you about incidents quickly, well before your 72-hour clock runs out.
Confirm your forensic cooperation path. DoD can request access to additional information or equipment for forensic analysis. Make sure your vendor contracts let you grant it. (DFARS 252.204-7012(f))

Sources

Next step

If a vendor incident hit your CDI today, would you know within 72 hours? PolicyCortex reads live Azure configuration and maps it to NIST 800-171 controls. The evidence is already there when you report.