# DFARS 252.204-7012 Cyber Incident Report Template

> Source: https://netray.co/tools/dfars-252-204-7012-cyber-incident-report-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in internal record to collect the details you need for a DFARS 7012 cyber incident report: timeline, systems, CUI impact, preservation and notifications.

## Category

compliance-legal

## Industry

Defense Contracting

## Region

United States

## Audience

- IT security lead
- Compliance manager
- Contracts manager

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Ridgeline Defense Components LLC

#### CAGE code

**Key:** cage

**Type:** text

**Default:** 1A2B3

#### Reporter / incident lead

**Key:** reporter

**Type:** text

**Default:** A. Morgan, Information Security Manager

#### Date and time discovered

**Key:** discovered

**Type:** text

**Default:** 2026-10-12 14:20 local

#### Date and time reported to DoD

**Key:** reported

**Type:** text

**Default:** 2026-10-14 09:05 local

#### Affected contracts

**Key:** contracts

**Type:** textarea

**Default:** Contract FA0000-26-C-0000 (example), subcontract for guidance housing assemblies.

#### Incident summary

**Key:** summary

**Type:** textarea

**Default:** Suspicious logins were detected on a file server containing engineering drawings. Credentials were reset and the server was isolated.

#### Systems and data affected

**Key:** systems

**Type:** textarea

**Default:** Engineering file server FS-ENG-02. Drawings marked CUI may have been accessed or copied.

#### CUI involved

**Key:** cui

**Type:** select

**Options:**

- Confirmed
- Suspected
- No CUI involved
- Under investigation

**Default:** Suspected

#### Malicious software found

**Key:** malware

**Type:** select

**Options:**

- Yes, isolated for submission
- Yes, not yet isolated
- No
- Unknown

**Default:** Yes, isolated for submission

#### Forensic images preserved

**Key:** images

**Type:** select

**Options:**

- Yes, preserved
- In progress
- No

**Default:** In progress

#### Containment and recovery actions

**Key:** actions

**Type:** textarea

**Default:** Server isolated, credentials reset, MFA enforced, logs exported, endpoint scan completed.

**Blocks:**

#### Cyber Incident Record

**Body:** Company: {{company}}
CAGE code: {{cage}}
Incident lead: {{reporter}}
Discovered: {{discovered}}
Reported to DoD: {{reported}}

#### Affected contracts

**Body:** {{contracts}}

#### Incident summary

**Body:** {{summary}}

#### Systems and data affected

**Body:** {{systems}}

CUI involved: {{cui}}

#### Malware and evidence

**Body:** Malicious software: {{malware}}
Forensic images preserved: {{images}}

Captured images and relevant monitoring data are to be preserved for at least 90 days from the date of the report so DoD can request them. Malicious software is submitted to the DoD Cyber Crime Center as directed.

#### Containment and recovery

**Body:** {{actions}}

#### Notification checklist

**Table:**

**Columns:**

- Step
- Owner
- Done

**Rows:**

**0:** Report within 72 hours of discovery via the DoD reporting portal

**1:** Incident lead

**0:** Use a medium assurance certificate to access the portal

**1:** IT security

**0:** Notify prime contractor or contracting officer as required

**1:** Contracts

**0:** Submit malware to DC3 as directed

**1:** IT security

**0:** Preserve images and logs

**1:** IT security

**0:** Notify subcontractors in the affected scope

**1:** Contracts

**0:** Open corrective action and update SSP and POA&M

**1:** Compliance

#### Approvals

**Signatures:**

- Incident lead
- Compliance manager
- Senior executive

**Notes:** This is an internal worksheet, not the official report. File the actual report through the DoD portal as required by DFARS 252.204-7012 and your contract, and confirm current reporting steps. This template is a starting point, not legal advice.

## Content

**Intro:** DFARS 252.204-7012 requires contractors with covered defense information to rapidly report cyber incidents that affect their systems or the CUI on them. This template collects the facts in one place so the report is accurate and on time.

**Sections:**

#### How to use the template

**Body:** Open it the moment an incident is suspected and fill the fields as facts become known. Timestamps matter most, because the clause sets a 72-hour reporting window from discovery. Record the contracts involved, the systems and data touched, whether CUI is confirmed or only suspected, and what you have done to contain it. Export it to PDF or Word to share with counsel, your prime and your contracting officer.

#### What the clause expects

**Body:** Under DFARS 252.204-7012, a covered contractor must report cyber incidents that affect a covered contractor information system or the covered defense information residing on it. The report goes to DoD within 72 hours of discovery, using a medium assurance certificate. The contractor must also preserve and protect images of affected systems and relevant monitoring data for at least 90 days, and submit identified malicious software to the DoD Cyber Crime Center.

**Bullets:**

- Report within 72 hours of discovery
- Medium assurance certificate to access the portal
- Preserve images and monitoring data for at least 90 days
- Submit malicious software to DC3

#### Preparing before an incident

**Body:** Most delays come from not knowing who holds the certificate, who may speak for the company, or which contracts are affected. Decide those roles in advance, keep the certificate current, and maintain an inventory of systems that hold CUI. Practise the process in a tabletop exercise so the first real report is not also the first time anyone has used the portal.

#### Common mistakes

**Body:** Companies lose time by waiting for certainty before reporting, wiping affected hosts before imaging them, and forgetting subcontractors who also handle the data. Others forget that the clock runs from discovery, not from confirmation of data loss. Report what you know, update as the investigation proceeds, and keep the evidence chain intact.

**Cta:** Netray can help set up private, on-prem log analysis and evidence collection so you can answer these questions faster, without sending logs to a third-party cloud.

**Faq:**

#### How fast must a cyber incident be reported?

**Answer:** DFARS 252.204-7012 requires a report to DoD within 72 hours of discovery of a cyber incident that affects a covered contractor information system or covered defense information. Start the clock from discovery, not from the end of your investigation.

#### What is a medium assurance certificate?

**Answer:** It is a DoD-approved external certificate used to access the DoD incident reporting portal. Contractors need one in place before an incident, because obtaining it takes time and cannot be rushed once the 72-hour window is running.

#### How long must I keep images and logs?

**Answer:** The clause requires preserving and protecting images of all known affected information systems and relevant monitoring and packet capture data for at least 90 days from the submission of the report, so DoD can request them for analysis.

#### Does this template replace the official report?

**Answer:** No. It is an internal record that helps you assemble facts quickly. The official report must be filed through the DoD portal as the clause requires, and your counsel should review any statements about scope or impact.

## Search terms

dfars 7012 incident report template, dfars 252.204-7012 72 hour reporting, dibnet incident report worksheet, cyber incident report template defense, covered defense information incident, dfars cyber incident checklist, cui breach report template, dod cyber incident reporting form

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json