Defense contracts: the 72-hour cyber incident clock

Defense contracts that include the DFARS covered-defense-information clause set a reporting clock. The clause defines rapidly report as within 72 hours of discovery of any cyber incident 1.

The clock starts at discovery, not when you finish investigating. Decide in advance who reports and who signs off.

Worked example. Contractor F discovers suspicious access late on a Friday. Its runbook names the person who files the report, so the report goes in on Sunday instead of waiting for a Monday meeting.

Check 1

Under DFARS 252.204-7012, what does "rapidly report" mean?Within 72 hours of discovery of any cyber incidentWithin 30 days of discoveryAt the next contract review

Check 2

From when does the 72-hour reporting window run?Discovery of the cyber incidentCompletion of the investigationThe contracting officer's request

Progress is saved in this browser only.

Indented paragraphs are invented worked examples. Tool links open Bids2Bank and need a free account.

Next lesson: CMMC: levels, assessments and timing

Defense contracts: the 72-hour cyber incident clock

By the end you can