DFARS 252.204-7012 requires contractors to preserve images of affected systems and relevant monitoring and packet capture data for at least 90 days after the cyber incident report is submitted. That is only possible if logs exist, retention is long enough and someone knows how to take an image without destroying evidence.
What must be kept
The clause text names images of known affected information systems and relevant monitoring or packet capture data. The period runs for at least 90 days from submission of the report. DoD may also request additional access for forensic analysis.
The clause does not tell you how to build your logging. That part is your design.
Decide what is in scope
List the systems that handle covered information, then for each one note the logs and images you would need. A short table is enough:
- system and owner
- log types available
- retention period today
- where an image would be stored
- who is allowed to take it
If a row says retention of 14 days, you have found a gap before the incident rather than during it.
Retention math
Remember the 90 days begins after you report, and a report can come days after the intrusion started. Intruders are often present for a while before discovery, so useful logs predate the incident. Aim for retention that covers the time to detect, the time to report and the 90 days, not just the last number.
Chain of custody
Evidence is only helpful if you can show it was not changed. Keep a simple record: who took it, when, with what tool, hash of the result, where it is stored, who accessed it. Store hashes separately from the images. Restrict access to a small group.
Storage
Write once or locked storage is best, with access logging on the storage itself. Keep it inside your controlled environment so you do not create a second exposure of covered information. Check how that storage is classified for the same rules.
Do not clean up too early
Teams often rebuild affected servers immediately. Rebuild after imaging, and record that you did. Put a line in the runbook: image first, then remediate.
Practice
Take one non critical server and image it as a drill. Time it. Note the permissions you did not have. Fix those.
Safeguard's compliance evidence automation can keep records about your controls current, but incident images and packet captures are held in your own forensic tooling.
A short readiness test
Pick a system in scope and ask five questions. Can we show its logs for the last 90 days? Do we know who could take an image today? Do they have the tool and the access? Where would the image go? Who would record the hash? If any answer is unclear, write the fix as a ticket with an owner and a date. Repeat for the next system. Even three systems tested this way will show you the pattern of weaknesses, and it is usually the same pattern everywhere, such as short retention or no named imaging owner.
Quick check
Does the 90 days start at discovery?
Per the clause text, the preservation period is at least 90 days after the report is submitted.
Sources
Last reviewed: 19 October 2026.
