ยท DFARS
DFARS 7012 Cyber Incident Reporting: 72-Hour Obligations
DFARS 252.204-7012 sets a 72-hour cyber incident reporting clock that starts at discovery and requires DIB contractors to submit a DIBNet report, preserve evidence for 90 days, and submit malware to DC3 when found.