The 72-Hour Clock: DFARS Cyber Incident Reporting and Why Silence Is the Real Risk

Published 2026 | TIKC NewsWire

For defense contractors, cybersecurity is no longer just an IT concern. It is a contract obligation with a stopwatch attached. If you handle certain sensitive defense information, a single clause, DFARS 252.204-7012, requires you both to protect that information and to report a cyber incident to the Department of Defense within a strict window. Understanding this clause matters because the biggest legal danger is not always the breach itself. It is failing to safeguard, failing to report, or misstating what you did.

What the clause requires

DFARS 252.204-7012 applies when a contract involves covered defense information, a category of controlled unclassified information. The clause imposes two core duties. First, you must provide adequate security on the covered information systems, which generally means implementing the security controls in NIST SP 800-171. Second, when a cyber incident affects covered defense information or your ability to perform, you must rapidly report it to DoD, generally within 72 hours of discovery, and take specified steps like preserving images of affected systems.

Seventy-two hours is not a lot of time

The reporting clock is the part contractors underestimate. When you discover an incident, you have roughly three days to report it through the required DoD channel, which means you need to have decided in advance who investigates, who makes the call, and how you file. A company that waits until a breach to figure out its process will blow the deadline. The clause also expects you to preserve evidence and cooperate, so your incident-response plan has to account for the government’s needs, not only your own recovery.

Where this becomes a False Claims Act problem

Here is the connection that has driven a wave of enforcement. The safeguarding requirement is tied to certifications, including the security assessment score you report. If a contractor certifies compliance with the required controls that it has not actually implemented, or claims a security posture it does not have, that misrepresentation can support a False Claims Act case with treble damages. Recent settlements have made clear that inaccurate cybersecurity self-assessments are a live fraud risk, and they often surface through audits and whistleblowers, not through the breach itself. The lesson is that your certification must match reality.

Flow-down and the whole supply chain

The clause does not stop at your walls. Its requirements flow down to subcontractors that handle covered defense information, and a subcontractor is generally expected to report incidents both to DoD and to you. That means your compliance depends partly on your suppliers, so you need to know which of them touch covered information and confirm they can meet the safeguarding and reporting duties. A weak link in the chain is a risk to your contract, not just theirs.

What to do now

• Identify covered defense information. Know which contracts and systems involve it, so you know where the clause applies.
• Implement the required controls. Actually put the NIST SP 800-171 safeguards in place, and make your assessment score honest.
• Build a 72-hour reporting plan. Decide in advance who investigates, who decides, and how you file with DoD.
• Keep certifications truthful. Never claim a security posture you have not achieved. That gap is the FCA risk.
• Flow it down and verify. Confirm subcontractors that handle covered information can safeguard and report as required.

In defense work, protecting the government’s information is part of the job, and reporting honestly and on time is how you prove you take it seriously. Build the plan before you need it, and keep every certification true. Brick by brick.

FAQ

When does DFARS 252.204-7012 apply?

When a contract involves covered defense information, a type of controlled unclassified information. The clause requires adequate safeguarding and rapid reporting of cyber incidents.

How fast do I have to report a cyber incident?

Generally within 72 hours of discovering an incident that affects covered defense information or your ability to perform, through the required DoD reporting channel, along with steps like preserving affected systems.

How does this create False Claims Act risk?

The safeguarding requirement is tied to certifications and a security assessment score. Certifying controls you have not implemented, or a posture you do not have, can support a False Claims Act case with treble damages.

Do these rules apply to my subcontractors?

Yes. The requirements flow down to subcontractors that handle covered defense information, and they are generally expected to report incidents to DoD and to you.

Sources

Defense Federal Acquisition Regulation Supplement. (2026). Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

National Institute of Standards and Technology. (2026). SP 800-171, Protecting Controlled Unclassified Information.

This article is general information, not legal advice.