# DFARS 252.204-7012 Cyber Incident Report Template

> Source: https://netray.co/tools/dfars-cyber-incident-report-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An internal worksheet document that gathers the facts needed to file a cyber incident report on a covered defense information system within the required window.

## Category

compliance-legal

## Industry

Defense Contracting

## Region

United States

## Audience

- IT security lead
- Compliance manager
- Defense supplier

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Contractor name

**Key:** company

**Type:** text

**Default:** Apex Precision Components Inc.

#### CAGE code

**Key:** cage

**Type:** text

**Default:** 1ABC2

#### Internal incident ID

**Key:** incident_id

**Type:** text

**Default:** INC-2026-0042

#### Date and time discovered

**Key:** discovered

**Type:** text

**Default:** 2026-10-18 14:20 local

#### Reported internally by

**Key:** reporter

**Type:** text

**Default:** Service desk analyst

#### Affected contracts

**Key:** contracts

**Type:** textarea

**Default:** List contract numbers and contracting officers for programs whose covered defense information may be affected.

#### Incident type

**Key:** type

**Type:** select

**Options:**

- Suspected unauthorized access
- Malware or ransomware
- Data exfiltration
- Lost or stolen device
- Insider misuse
- Other

**Default:** Suspected unauthorized access

#### Systems affected

**Key:** systems

**Type:** textarea

**Default:** Engineering file server, one workstation, and the VPN gateway log.

#### CUI or covered defense information involved

**Key:** cui

**Type:** textarea

**Default:** Unknown at time of drafting. Drawing files for machined housings may have been accessible.

#### Containment actions taken

**Key:** contain

**Type:** textarea

**Default:** Account disabled, workstation isolated from network, VPN sessions revoked.

#### Evidence preserved

**Key:** preserve

**Type:** textarea

**Default:** Disk image of workstation, firewall and VPN logs, and domain controller security logs exported.

**Blocks:**

#### Cyber Incident Report Worksheet

**Body:** Contractor: {{company}}
CAGE code: {{cage}}
Internal ID: {{incident_id}}
Discovered: {{discovered}}
Reported internally by: {{reporter}}

#### 1. Contracts Affected

**Body:** {{contracts}}

#### 2. Incident Description

**Body:** Type: {{type}}

Systems affected:
{{systems}}

CUI or covered defense information involved:
{{cui}}

#### 3. Containment and Preservation

**Body:** Containment:
{{contain}}

Evidence preserved:
{{preserve}}

#### 4. Reporting Clock

**Table:**

**Columns:**

- Step
- Owner
- Due
- Done

**Rows:**

**0:** Rapid report submitted to DoD via the required portal

**2:** Within 72 hours of discovery

**0:** Medium assurance certificate confirmed available

**2:** Before filing

**0:** Malicious software submitted to DC3 if found

**2:** As directed

**0:** Media images preserved and retained

**2:** At least 90 days from report

**0:** Prime contractor or higher-tier notified per contract

**2:** Per flow-down

#### 5. Approvals

**Signatures:**

- Incident lead
- Security officer
- Executive

**Notes:** This is an internal preparation worksheet, not the official report form. DFARS 252.204-7012 requires rapid reporting, generally within 72 hours of discovery, through the DoD portal using a medium assurance certificate, plus preservation of images for at least 90 days. Confirm current requirements with counsel or your contracting officer. Not legal advice.

## Content

**Intro:** When a possible cyber incident touches covered defense information, the clock starts at discovery. This worksheet collects the facts you will need at the reporting portal so the first hours go to containment, not to hunting for details.

**Sections:**

#### How to use it

**Body:** Open a copy at the first sign of an incident and fill what you know, leaving unknowns explicit. Update it as the investigation progresses. Export to PDF or Word for the incident record. The reporting clock table keeps the 72-hour deadline, certificate readiness and evidence retention visible to everyone on the response team.

**Bullets:**

- Write the discovery time down exactly
- Note which contracts could be affected
- State unknowns as unknown, never guess
- Preserve evidence before rebuilding systems

#### What the clause expects

**Body:** DFARS 252.204-7012 asks contractors to report cyber incidents that affect a covered contractor information system or the covered defense information on it, or that affect the ability to perform operationally critical support. It also requires preserving and protecting images of affected systems and packet capture where available, and submitting any malicious software discovered. The portal needs a medium assurance certificate, which can take days to obtain, so get one before you need it.

#### Practical readiness tips

**Body:** Keep the certificate current, store the portal procedure in the runbook, and name two people who can file. Exercise the worksheet in a tabletop at least once a year. Check subcontractor flow-down terms too, since your subcontractors must report to you and, for some incidents, directly to DoD.

#### Common mistakes

**Body:** Wiping a machine before imaging it, waiting for complete certainty before reporting, and discovering on day two that nobody holds a certificate are the three classic failures. Report on what you know within the window and supplement later.

**Cta:** Netray builds private on-prem AI that can help triage logs without sending evidence outside your boundary. This worksheet is free and needs no contact.

**Faq:**

#### What is the DFARS 7012 reporting deadline?

**Answer:** The clause requires rapid reporting, generally within 72 hours of discovering a cyber incident that affects covered defense information or operationally critical support. Always verify the current clause text and any contract-specific terms with counsel.

#### Do I need a medium assurance certificate?

**Answer:** Yes, the DoD reporting portal requires a DoD-approved medium assurance certificate to submit a report. Obtaining one can take time, so arrange it in advance as part of incident readiness rather than during an event.

#### How long must I keep images?

**Answer:** The clause requires preserving images of affected information systems and relevant monitoring or packet capture data for at least 90 days from the report submission, so DoD can request them for a forensic analysis.

#### Should this worksheet be sent to DoD?

**Answer:** No. It is an internal preparation tool. The actual report is submitted through the DoD portal. Use this document to hold the facts and decisions behind that submission.

## Search terms

dfars 7012 incident report template, dfars cyber incident reporting 72 hours, cyber incident report template defense contractor, dibnet incident report preparation, cui incident response template, covered defense information incident form

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json