DFARS clause 252.204-7012 defines rapidly report as within 72 hours of discovery of any cyber incident, with reports made to DoD through the DIBNet portal. To do that, a contractor needs a reporting credential, a decision path, preserved evidence and someone who can write the report. None of that is easy to build mid incident.
What the clause says
The clause text on acquisition.gov defines "Rapidly report" as "within 72 hours of discovery of any cyber incident." Reports go through dibnet.dod.mil. Contractors and subcontractors need a DoD approved medium assurance certificate to file.
The clause also requires preserving images of affected systems and relevant monitoring and packet capture data for at least 90 days after the report is submitted, and giving DoD access to additional information and equipment for forensic analysis when requested.
Get the credential first
Obtaining a medium assurance certificate takes time. Companies that wait for an incident to start the process lose most of their 72 hours before they can file. Assign an owner, get the certificate, and test that it works. Renew before it expires.
Define what discovery means
The 72 hours start at discovery. Agree internally who can declare that discovery happened, and how a suspicion becomes a decision. Write a short runbook with named roles and a backup for each. Include out of hours contacts.
Decide who reports
If you are a subcontractor, the clause says subcontractors pass the incident report number to the prime or higher tier subcontractor once DoD assigns it. Know your upstream contacts before you need them, and check your subcontract for notice terms that may be tighter than the clause.
Build the evidence habit
Preserving images and logs for 90 days only works if your logs exist. Check retention on:
- authentication and VPN logs
- endpoint and server logs for systems in scope
- network flow or packet capture where you collect it
- build and deployment logs if software or CI is in scope
Decide where forensic images would be stored, who can take them, and how you would show nothing was altered.
Malware handling
Isolated malicious software goes to the DoD Cyber Crime Center, not to the Contracting Officer, per the clause. Put that line in the runbook so nobody emails a sample to the wrong place.
Drill it
Run a two hour tabletop twice a year. The usual finding is that nobody knows who holds the certificate. Fix that one thing and you have improved the odds more than any tool purchase.
Safeguard's asset discovery and compliance evidence automation can help you know what is in scope and keep records current. Legal interpretation of the clause belongs with your counsel.
Quick check
Do the 72 hours start when we confirm the attacker got in?
The clause says within 72 hours of discovery of any cyber incident. Get counsel's reading of how discovery applies to your facts.
Sources
Last reviewed: 19 October 2026.
