DFARS 252.204-7012 Cyber Incident Report Template
DFARS 252.204-7012 requires contractors with covered defense information to rapidly report cyber incidents that affect their systems or the CUI on them. This template collects the facts in one place so the report is accurate and on time.
Fill in
DFARS 252.204-7012 Cyber Incident Report Template
Cyber Incident Record
Company: Ridgeline Defense Components LLC CAGE code: 1A2B3 Incident lead: A. Morgan, Information Security Manager Discovered: 2026-10-12 14:20 local Reported to DoD: 2026-10-14 09:05 local
Affected contracts
Contract FA0000-26-C-0000 (example), subcontract for guidance housing assemblies.
Incident summary
Suspicious logins were detected on a file server containing engineering drawings. Credentials were reset and the server was isolated.
Systems and data affected
Engineering file server FS-ENG-02. Drawings marked CUI may have been accessed or copied.
CUI involved: Suspected
Malware and evidence
Malicious software: Yes, isolated for submission Forensic images preserved: In progress
Captured images and relevant monitoring data are to be preserved for at least 90 days from the date of the report so DoD can request them. Malicious software is submitted to the DoD Cyber Crime Center as directed.
Containment and recovery
Server isolated, credentials reset, MFA enforced, logs exported, endpoint scan completed.
Notification checklist
| Step | Owner | Done |
|---|---|---|
| Report within 72 hours of discovery via the DoD reporting portal | Incident lead | |
| Use a medium assurance certificate to access the portal | IT security | |
| Notify prime contractor or contracting officer as required | Contracts | |
| Submit malware to DC3 as directed | IT security | |
| Preserve images and logs | IT security | |
| Notify subcontractors in the affected scope | Contracts | |
| Open corrective action and update SSP and POA&M | Compliance |
Approvals
This is an internal worksheet, not the official report. File the actual report through the DoD portal as required by DFARS 252.204-7012 and your contract, and confirm current reporting steps. This template is a starting point, not legal advice.
Rehearse your DFARS incident process
We can walk through a tabletop scenario and show where on-prem logging helps you meet the clock.
Optional. The tool and every export work without this. No spam.
How to use the template
Open it the moment an incident is suspected and fill the fields as facts become known. Timestamps matter most, because the clause sets a 72-hour reporting window from discovery. Record the contracts involved, the systems and data touched, whether CUI is confirmed or only suspected, and what you have done to contain it. Export it to PDF or Word to share with counsel, your prime and your contracting officer.
What the clause expects
Under DFARS 252.204-7012, a covered contractor must report cyber incidents that affect a covered contractor information system or the covered defense information residing on it. The report goes to DoD within 72 hours of discovery, using a medium assurance certificate. The contractor must also preserve and protect images of affected systems and relevant monitoring data for at least 90 days, and submit identified malicious software to the DoD Cyber Crime Center.
- Report within 72 hours of discovery
- Medium assurance certificate to access the portal
- Preserve images and monitoring data for at least 90 days
- Submit malicious software to DC3
Preparing before an incident
Most delays come from not knowing who holds the certificate, who may speak for the company, or which contracts are affected. Decide those roles in advance, keep the certificate current, and maintain an inventory of systems that hold CUI. Practise the process in a tabletop exercise so the first real report is not also the first time anyone has used the portal.
Common mistakes
Companies lose time by waiting for certainty before reporting, wiping affected hosts before imaging them, and forgetting subcontractors who also handle the data. Others forget that the clock runs from discovery, not from confirmation of data loss. Report what you know, update as the investigation proceeds, and keep the evidence chain intact.
Frequently Asked Questions
How fast must a cyber incident be reported?
DFARS 252.204-7012 requires a report to DoD within 72 hours of discovery of a cyber incident that affects a covered contractor information system or covered defense information. Start the clock from discovery, not from the end of your investigation.
What is a medium assurance certificate?
It is a DoD-approved external certificate used to access the DoD incident reporting portal. Contractors need one in place before an incident, because obtaining it takes time and cannot be rushed once the 72-hour window is running.
How long must I keep images and logs?
The clause requires preserving and protecting images of all known affected information systems and relevant monitoring and packet capture data for at least 90 days from the submission of the report, so DoD can request them for analysis.
Does this template replace the official report?
No. It is an internal record that helps you assemble facts quickly. The official report must be filed through the DoD portal as the clause requires, and your counsel should review any statements about scope or impact.
Netray can help set up private, on-prem log analysis and evidence collection so you can answer these questions faster, without sending logs to a third-party cloud.
Related Tools
NIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Aerospace & DefenseNIST 800-171 POA&M Worksheet
An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
Aerospace & DefenseCUI Marking Checklist for DoD Contractors
A practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments.
Aerospace & DefenseDFARS 252.204-7012 Compliance Self-Assessment
A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
More Compliance & Contracts tools
See all- EAR ECCN Self-Classification Worksheet
- Technology Control Plan (TCP) Template
- Export License Tracking Worksheet
- ITAR USML Categories Reference Table
- NIST SP 800-171 System Security Plan (SSP) Template
- CMMC POA&M (Plan of Action and Milestones) Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- Foreign Person Visitor Access Request Template
- ITAR Technical Data Transfer Log Worksheet