DFARS

DFARS 252.204-7012 sets a 72-hour deadline to report a qualifying cyber incident through DIBNet, and the mechanics matter to meet the clause and support DoD follow-up.

DFARS 252.204-7012 sets a 72-hour cyber incident reporting clock that starts at discovery and requires DIB contractors to submit a DIBNet report, preserve evidence for 90 days, and submit malware to DC3 when found.

DoD removed DFARS 252.204-7019 and renumbered 252.204-7020, but the NIST SP 800-171 assessment and SPRS scoring cycle continues under CMMC and current contract clauses, so contractors need a clear, defensible approach to scoring, posting, and flowdown.

A DFARS 252.204-7012 playbook directs fast triage, evidence preservation, DIBNet reporting, and DC3 malware submission, mapped to NIST SP 800-171 incident response controls and grounded in your Microsoft cloud footing.

Prime contractors flow CUI obligations to subcontractors based on the specific data shared and the clauses in the subcontract, then add business terms that often raise the bar beyond the regulatory floor.

DFARS 252.204-7021 ties CMMC directly to DoD contracts and directs primes to flow the required level to subcontractors that handle FCI or CUI, with assessment specifics governed by 32 CFR part 170 and DoD guidance.