DFARS 252.204-7012 Cyber Incident Report Template
When a possible cyber incident touches covered defense information, the clock starts at discovery. This worksheet collects the facts you will need at the reporting portal so the first hours go to containment, not to hunting for details.
Fill in
DFARS 252.204-7012 Cyber Incident Report Template
Cyber Incident Report Worksheet
Contractor: Apex Precision Components Inc. CAGE code: 1ABC2 Internal ID: INC-2026-0042 Discovered: 2026-10-18 14:20 local Reported internally by: Service desk analyst
1. Contracts Affected
List contract numbers and contracting officers for programs whose covered defense information may be affected.
2. Incident Description
Type: Suspected unauthorized access
Systems affected: Engineering file server, one workstation, and the VPN gateway log.
CUI or covered defense information involved: Unknown at time of drafting. Drawing files for machined housings may have been accessible.
3. Containment and Preservation
Containment: Account disabled, workstation isolated from network, VPN sessions revoked.
Evidence preserved: Disk image of workstation, firewall and VPN logs, and domain controller security logs exported.
4. Reporting Clock
| Step | Owner | Due | Done |
|---|---|---|---|
| Rapid report submitted to DoD via the required portal | Within 72 hours of discovery | ||
| Medium assurance certificate confirmed available | Before filing | ||
| Malicious software submitted to DC3 if found | As directed | ||
| Media images preserved and retained | At least 90 days from report | ||
| Prime contractor or higher-tier notified per contract | Per flow-down |
5. Approvals
This is an internal preparation worksheet, not the official report form. DFARS 252.204-7012 requires rapid reporting, generally within 72 hours of discovery, through the DoD portal using a medium assurance certificate, plus preservation of images for at least 90 days. Confirm current requirements with counsel or your contracting officer. Not legal advice.
Incident readiness for CUI systems
Optional review of logging and evidence retention across your ERP and file systems.
Optional. The tool and every export work without this. No spam.
How to use it
Open a copy at the first sign of an incident and fill what you know, leaving unknowns explicit. Update it as the investigation progresses. Export to PDF or Word for the incident record. The reporting clock table keeps the 72-hour deadline, certificate readiness and evidence retention visible to everyone on the response team.
- Write the discovery time down exactly
- Note which contracts could be affected
- State unknowns as unknown, never guess
- Preserve evidence before rebuilding systems
What the clause expects
DFARS 252.204-7012 asks contractors to report cyber incidents that affect a covered contractor information system or the covered defense information on it, or that affect the ability to perform operationally critical support. It also requires preserving and protecting images of affected systems and packet capture where available, and submitting any malicious software discovered. The portal needs a medium assurance certificate, which can take days to obtain, so get one before you need it.
Practical readiness tips
Keep the certificate current, store the portal procedure in the runbook, and name two people who can file. Exercise the worksheet in a tabletop at least once a year. Check subcontractor flow-down terms too, since your subcontractors must report to you and, for some incidents, directly to DoD.
Common mistakes
Wiping a machine before imaging it, waiting for complete certainty before reporting, and discovering on day two that nobody holds a certificate are the three classic failures. Report on what you know within the window and supplement later.
Frequently Asked Questions
What is the DFARS 7012 reporting deadline?
The clause requires rapid reporting, generally within 72 hours of discovering a cyber incident that affects covered defense information or operationally critical support. Always verify the current clause text and any contract-specific terms with counsel.
Do I need a medium assurance certificate?
Yes, the DoD reporting portal requires a DoD-approved medium assurance certificate to submit a report. Obtaining one can take time, so arrange it in advance as part of incident readiness rather than during an event.
How long must I keep images?
The clause requires preserving images of affected information systems and relevant monitoring or packet capture data for at least 90 days from the report submission, so DoD can request them for a forensic analysis.
Should this worksheet be sent to DoD?
No. It is an internal preparation tool. The actual report is submitted through the DoD portal. Use this document to hold the facts and decisions behind that submission.
Netray builds private on-prem AI that can help triage logs without sending evidence outside your boundary. This worksheet is free and needs no contact.
Related Tools
NIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsDefense Subcontractor Flow-Down Tracker Worksheet
A supplier-by-supplier register of flowed-down clauses, CUI access, certification status and acknowledgement dates.
Aerospace & DefenseDFARS 252.204-7012 Compliance Self-Assessment
A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
More Compliance & Contracts tools
See all- EAR ECCN Self-Classification Worksheet
- Technology Control Plan (TCP) Template
- Export License Tracking Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- ITAR USML Categories Reference Table
- Foreign Person Visitor Access Request Template
- ITAR Technical Data Transfer Log Worksheet
- Export Classification Matrix Worksheet (USML and ECCN)
- End-Use and End-User Statement Template