Rapid Reporting to DIBNet: Mechanics of a 7012 Incident Filing

DFARS 252.204-7012 sets a 72-hour deadline to report a qualifying cyber incident through DIBNet. That report triggers preservation, malware handling, and cooperation duties that go beyond an online form. Your team needs a clock, a checklist, and a clean handoff to DoD.

The 72-hour DIBNet clock

DoD defines rapidly report as reporting within 72 hours of discovery. The timer starts when your team discovers a cyber incident that meets the clause trigger, not when the investigation reaches comfort or closure. Treat the discovery timestamp as an incident artifact. Record who made the call and why, then start assembling the data the portal requires.

DIBNet receives the report. The Defense Cyber Crime Center, DC3, serves as the focal point and repository for DIB incident reporting. You do not need a complete forensic timeline to file. Submit the required elements identified in the portal with the evidence you have, then continue analysis and preservation as the clause requires.

Reportable incident scope

The clause requires a report to DIBNet when a cyber incident affects one of two scopes.

A covered contractor information system or covered defense information on that system.
The contractor’s ability to perform contract requirements identified as operationally critical support in the contract.

Contract language and your CUI boundary drive this decision. Map systems and data flows in your system security plan so responders can answer a simple question without delay: did the event touch a covered system or covered defense information. If you need a refresher on the clause mechanics and key terms, see our overview here: DFARS 252.204-7012 Requirements. For boundary scoping, see CMMC Scoping the CUI Boundary.

Pre-filing information collection

DoD directs contractors to review evidence of compromise before or as part of reporting. Your responders examine compromised computers, servers, specific data, and user accounts. They analyze affected systems and any other network systems the adversary may have accessed. Build a short pre-filing kit your team can pull from muscle memory.

Contract context and identifiers. Gather contract number, program identifier if present, prime or subcontractor status, and points of contact for the contracting officer and prime.
Technical indicators and impact. Collect attacker indicators you observed, affected system names and roles, affected data categories, and a summary of operational effects if any.

Keep the kit light so the clock does not beat the team. Use the live DIBNet fields as your source of truth for required elements, since the clause points to the portal for the minimum content. Validate those fields on a cadence and capture a screenshot in your incident runbook so responders see the current prompts.

Submission steps and incident number flow

File the report through DIBNet within the 72-hour window. Treat the submitter role as part of your incident roster so you do not waste minutes on access during a live response. After submission, DIBNet assigns a report number. That number matters for supply-chain coordination.

Subcontractor flow. A subcontractor provides the assigned report number to the prime. A lower-tier subcontractor passes the number to the next higher tier until the prime receives it.
Internal tracking. Your responder logs the report number, the timestamp, and a copy of the submitted fields. The team stores this package with the case record.

DoD treats the cyber incident report as information created by or for DoD. Plan to lock down distribution inside your company and send the number and essentials to those who need it to meet contract obligations, nothing more.

Preservation, malware, and DoD follow-up

The clause sets three follow-on duties. Each one benefits from a prepared workflow and a standing tool stack that preserves original evidence.

Preservation duty. Preserve images of information systems and other relevant information in original format, and protect that evidence from alteration, destruction, or concealment for the period the clause requires. Keep chain-of-custody notes, hashes, and storage locations in the case file, and confirm retention timers match the clause before closure.
Malware and access duty. Provide any malicious software you detect and isolate. On DoD request, provide media or access to covered contractor information systems and equipment so DoD can conduct a damage assessment or decide it has no further interest.

Build a simple play in your runbook for each duty with the tool and owner named. Storage selection, encryption method, and transfer path should not be ad hoc during a breach. If your team uses external forensics help, lock in a method to hand the preserved originals back to your company for retention under the clause.

Contract and team coordination

DIBNet filing does not replace contract notifications and internal containment. Coordinate three threads in parallel and track each to completion.

Contract communications. Follow your contract’s direction for notifying the contracting officer, program office, or prime. Send only what the contract calls for, and reference the DIBNet report number when you have it.
Technical response. Contain, eradicate, and recover in line with your incident plan, while preserving the originals noted above. Track remediation in your case system and route open items to your risk owners.

Use your system security plan to name the covered contractor information systems, the data types, and the incident roles, so responders do not debate scope during a live event. After containment, route unresolved corrective actions into your POA&M process so owners track due dates and closure, and so you can explain remediation status to program officials if they ask. For plan structure and artifacts that support incident work, see System Security Plan for NIST 800-171 and POA&M Management for CMMC.

Practical mechanics checklist

You can run a short, repeatable sequence that meets the clause and supports DoD requests without drama.

Start the clock. Record discovery, assign the reporting owner, and open the case with the current DIBNet required fields.
File and preserve. Submit within 72 hours, capture the report number, preserve original images and logs, and stage any isolated malware for transfer.

After the report, prepare for questions. DC3 or other DoD personnel may ask for clarifications, additional indicators, or access to systems or media. Keep your case owner and counsel in the loop, and avoid mixing incident facts with speculative impact statements. The clause sets the bar. Meet it with clear records and prompt cooperation.

This post describes the mechanics of DFARS 252.204-7012 reporting and related duties. It does not change contract terms. You remain responsible for your incident program and any reporting, preservation, or access your contracts or the clause require.