The 72-hour playbook for federal-construction subs when a cyber incident hits. What to report, when to report, and which DoD portal accepts the submission.
Why federal-construction subs need a DFARS 252.204-7012 incident reporting checklist
A federal-construction sub on a $50M base contract gets phished on a Tuesday. By Wednesday morning the IT lead realizes the project manager’s mailbox forwarded six months of RFIs, schedules, and submittals to an external address. By Wednesday afternoon, the prime’s contracting officer is on the phone asking what the firm has reported to DoD. The clause buried in the subcontract, DFARS 252.204-7012, gives the sub 72 hours from the moment the incident is “discovered” to file a report through DIBNet, the DoD Cyber Crime Center’s reporting portal. The clock has been running since Tuesday. DFARS 252.204-7012 is the clause that turned cybersecurity from an IT problem into a contract-performance problem for the entire defense industrial base. It applies to any contract, prime or sub, that touches Covered Defense Information (CDI), which on a federal-construction job means almost every project document the agency hasn’t published publicly: drawings, specifications, RFIs, schedules, submittals, ROEs. If you handle CDI and a “cyber incident” hits the system that processes or stores it, the clause demands a specific sequence: identify, report, preserve, cooperate, document. Each step has a deadline. Each deadline has audit consequences.
This is not the same conversation as CMMC. CMMC is about readiness. Proving on a yearly attestation that the 17 (Level 1) or 110 (Level 2) practices are in place. DFARS 252.204-7012 is about response. What you do in the 72 hours after the breach is identified. A firm can be perfectly CMMC-compliant and still botch the 7012 response, because the 7012 obligations don’t show up in the SPRS attestation. They show up in the contract itself, get flowed down by every prime, and only become visible when the firm needs them most: in the middle of an active incident, with a contracting officer on the phone, with the subcontract’s reporting deadline counting down.
Almost every checklist on the internet for DFARS 7012 today is written by cyber-insurance brokers (selling policies) or by Beltway defense consultants (selling assessments). Neither audience speaks construction. They explain the clause as if the firm has a 24/7 SOC, a CISO, and a corporate counsel on retainer. The federal-construction sub-tier has none of those. It has a project manager who got phished, an IT generalist who supports six trailers, and a CFO trying to understand whether the company just lost a $5M federal contract.
The items in this checklist are the actual sequence. Twelve actions, in order, that map to the discrete obligations the clause imposes. Items 6 (DIBNet 72-hour report) and 4 (90-day forensic image retention) are the two most-failed obligations in real DFARS 7012 enforcement actions. Items 7 (the MAC PKI / ECA certificate prerequisite for DIBNet access) and 11 (sub-tier flow-down notification) are the two most-overlooked. The rest are the operational backbone of a defensible response. The artifacts a contracting officer expects to see when the dust settles, and the artifacts that determine whether the contract gets terminated for cause or merely audited.
We built this checklist after watching a federal-construction sub burn 96 hours figuring out which DoD portal accepted the report, while the 72-hour clock kept running. The fix was a printed binder, kept in the IT lead’s drawer, with the DIBNet URL on page one and the MAC PKI request form on page two. That binder became the muscle memory that turns a panic into a process. This template is that binder.
Who this checklist is for
- Federal-construction subcontractors on DoD-prime projects who handle CDI under flow-down clauses
- 8(a) federal subs on DoD set-aside contracts that include
- Construction-firm IT/operations leads who would run the actual incident response
- Compliance officers who own DFARS reporting obligations and the contracting-officer relationship
- Prime contractors preparing sub-tier flow-down packages and verifying sub-tier 7012 readiness
If your subcontract is silent on DFARS 7012, this checklist still applies. The clause flows down by default on any DoD prime contract. If you’re already CMMC Level 2 ready via the Level 1 self-assessment, this checklist is the missing response-side companion to your readiness binder.
The actions inside the 72-hour DFARS reporting window
The checklist covers the sequenced actions every federal-construction sub must run inside the 72-hour DFARS reporting window. Identification through corrective-action documentation, in operational order:
- Identify and confirm the cyber incident. Trigger conditions include unauthorized access, exfiltration of CDI, ransomware encryption of project files, or destruction of records on a system that processes or stores CDI. Phishing-driven mailbox-forwarding rules and unauthorized cloud-folder access are the two most-common triggers on a construction sub. Document the moment of “discovery”. The 72-hour DFARS clock starts the second a person inside the firm knows or reasonably should know an incident occurred. That timestamp becomes the cornerstone of every downstream artifact.
- Scope which CDI was involved. Pull the contract list, identify which contracts include the DFARS 252.204-7012 clause, and map the affected systems against the project documents they hold. If the phished mailbox handled RFIs and submittals for three DoD jobs, all three are in scope. CDI on construction jobs means non-public RFIs, drawings, schedules, submittals, agency-provided specifications, and ROEs. Anything the contracting agency hasn’t released publicly. Scope determines who downstream needs the report and which contracts trigger the flow-down obligations.
- Activate the incident response plan. Pull the firm’s written IR plan (which DFARS 7012 implicitly requires you to have via NIST 800-171 controls 3.6.1–3.6.3). Convene the response team. Typically owner/CEO, IT lead, project manager for the affected jobs, and outside counsel if the incident involves potential PII or contract-termination exposure. Assign the incident commander. If the firm has cyber-insurance, notify the carrier in parallel. Most policies have their own 24-hour notification clauses that run concurrently with DFARS.
- Preserve forensic evidence. 90-day image retention. DFARS 252.204-7012 paragraph (e) requires the contractor to “preserve and protect images of all known affected information systems…and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report.” That means full-disk images of every affected machine, mailbox snapshots, network logs, and EDR telemetry. Frozen in place, hashed, and retained for the full 90 days even if you’ve already wiped and rebuilt the systems. This is the single most-failed obligation in real 7012 enforcement; firms triage the breach, restore systems, and lose the forensic state DoD later asks to inspect.
- Assess affected information systems and CDI involvement. The DIBNet report requires you to describe what was accessed, what was exfiltrated, and how the incident affected the systems. This is the difference between “an attacker had foothold in our mailbox for 6 hours” and “an attacker exfiltrated 3,200 documents including signed RFIs from project ABC-1234.” The deeper the analysis here, the more credible the report. If the firm doesn’t have in-house forensic capability, this is the line item that should be outsourced to a DFIR firm. Same-day engagement, billable, but the cost of a botched assessment is contract termination.
- Report to DoD via DIBNet within 72 hours. Submit the cyber incident report at dibnet.dod.mil within 72 hours of incident discovery. The report includes the incident date/time, contracting agency, affected contracts, type of incident, type of CDI involved, point of contact, and a narrative description. This is non-negotiable. DFARS 252.204-7012(c)(1)(ii) is explicit. The 72-hour window includes weekends and federal holidays. Once submitted, the contractor receives an Incident Collection Format (ICF) reference number; that number anchors every subsequent artifact.
- Obtain MAC PKI / ECA certificate for DIBNet access. DIBNet requires a DoD-approved Medium Assurance Certificate (MAC). Typically issued by an External Certification Authority (ECA) like IdenTrust or DigiCert. The certificate cannot be obtained inside the 72-hour window. Provisioning takes 5–10 business days. Every federal-construction sub that handles CDI should obtain the MAC PKI certificate proactively, before an incident, and assign it to a designated incident reporter (typically the IT lead or compliance officer). Firms that skip this step and try to obtain a MAC mid-incident are the firms that miss the 72-hour deadline.
- Provide media for damage assessment if requested. Paragraph (f) of the clause: if DoD requests it, the contractor must provide media (forensic images, logs, CDI samples) for damage assessment within a stated period. Be ready to ship physical encrypted drives or transfer images via DoD’s secure file transfer. Maintain chain-of-custody documentation from the moment of imaging through the moment of DoD receipt. The contractor is responsible for the protection of CDI during transfer. DoD provides the receiving instructions.
- Cooperate with DoD investigation. The clause obligates the contractor to give DoD reasonable access to information and personnel involved in the incident. In practice, this means the IT lead and the incident commander should be available for follow-up calls, the firm should preserve relevant communications (including internal Slack or Teams messages discussing the incident), and outside counsel should not obstruct DoD interviews. Cooperation is itself a contractual obligation; obstruction triggers cure-notice and termination-for-cause exposure on the underlying contract.
- Isolate compromised systems. Take affected machines off the network. Disable compromised credentials. Revoke OAuth tokens on the project portals. Force password resets on every account that interacted with the affected system in the last 90 days. Document the timestamp of each containment action. That timeline becomes part of the post-incident report. Containment must happen after forensic preservation (item 4); flipping the order destroys evidence DoD later expects to see.
- Notify subs / primes per flow-down obligations. DFARS 252.204-7012 flows down to lower-tier subs. If the affected system processes documents from your own subs (e.g., your concrete sub’s submittals are in the breached mailbox), they have their own 7012 obligations. Conversely, if you are the affected sub, the prime needs to know. Most subcontracts include explicit notification clauses requiring you to inform the prime within 24–48 hours of any DFARS-reportable incident. Work the flow-down both directions inside the 72-hour window.
- Document corrective action and lessons learned. After the incident is contained, the contractor must document the corrective actions taken, patches deployed, controls implemented, training delivered, and retain that documentation alongside the DIBNet report. The lessons-learned packet should be ready for the prime’s contracting officer if requested. This is where the firm proves it learned from the incident; absence of corrective documentation is itself a finding in DoD’s post-incident review and a discoverable artifact in any False Claims Act exposure that follows.
How to run the checklist when an incident hits
Print the checklist and store a copy in the IT lead’s drawer; store another digitally in the compliance folder shared with outside counsel and the cyber-insurance contact. The day of the incident:
- Note the
- discovery timestamp at the top of the checklist. This is your 72-hour anchor.
- Work items 1–5 in parallel where possible (scope and IR plan activation can run simultaneously). Items 4 and 10 must be sequenced in that order, preserve before isolate.
- File the DIBNet report (item 6) by hour 60 at the latest, not hour 71. Buffer the deadline.
- Flow item 11 to subs and primes inside hour 24. The longer you wait, the harder the flow-down conversation.
- Items 8, 9, and 12 unfold over days/weeks after the 72-hour window closes. Keep the checklist open until each line is signed and dated.
The 30-minute proactive version: print the checklist, run through it as a tabletop exercise once a year with the IT lead, the project manager, and outside counsel. Pre-stage item 7 (MAC PKI) so it isn’t the obstacle when an incident hits.
Stop running this from a panicked email thread
The actions in this checklist are the difference between a defensible DFARS 7012 response and a contract-termination conversation with your prime’s contracting officer. The hard part isn’t the response itself. It’s having the artifacts ready, the MAC PKI cert provisioned, the IR plan rehearsed, and the 90-day forensic-image retention process built before the incident hits. Contracts Connected’s compliance dashboard keeps every DFARS clause, flow-down obligation, and incident-readiness artifact indexed in one place, so when the 72-hour clock starts, the binder is already on hand.
For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.
Frequently asked questions about DFARS 252.204-7012 incident reporting
What is DFARS 252.204-7012 and who does it apply to?
DFARS 252.204-7012 is the Department of Defense’s “Safeguarding Covered Defense Information and Cyber Incident Reporting” clause. It applies to every DoD prime contract and every subcontract under a DoD prime that involves Covered Defense Information (CDI). On a federal-construction project, CDI typically includes RFIs, submittals, schedules, agency-provided specifications, and any non-public project documents. The clause flows down to every tier of subcontractor; the obligation is triggered the moment the firm receives or generates CDI under the contract, regardless of whether the firm has actually been breached.
How fast must I report a cyber incident under DFARS 7012?
Within 72 hours of discovery. The clause language at paragraph (c)(1)(ii) is explicit: “rapidly report cyber incidents…within 72 hours of discovery of any cyber incident.” The 72 hours runs continuously through weekends and federal holidays. “Discovery” is the moment a person inside the firm knew or reasonably should have known the incident occurred, not when the breach actually happened, and not when the IT team formally classified it. Document the discovery timestamp; the 72-hour clock anchors to it.
Where do I file the DFARS cyber incident report?
At DIBNet. The DoD Cyber Crime Center’s incident reporting portal at dibnet.dod.mil. Submission requires a DoD-approved Medium Assurance Certificate (MAC), typically obtained from an External Certification Authority like IdenTrust or DigiCert. The certificate provisioning takes 5–10 business days, which means firms must obtain the MAC PKI cert before an incident occurs. It cannot be acquired and used inside the 72-hour reporting window.
What counts as a cyber incident requiring DFARS 7012 reporting?
Per the clause definition, a cyber incident is “actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.” Practical examples on a construction sub: phishing leading to mailbox compromise, ransomware on a BIM workstation, unauthorized access to a project-portal account, exfiltration of project drawings or specifications. The threshold is whether CDI was potentially affected. If yes, the report obligation triggers, even if exfiltration is not yet confirmed.
What is the 90-day forensic preservation requirement?
Paragraph (e) of DFARS 252.204-7012 requires the contractor to “preserve and protect images of all known affected information systems…and all relevant monitoring/packet capture data for at least 90 days” from the submission of the cyber incident report. That means full-disk images, mailbox snapshots, EDR telemetry, network logs. All frozen, hashed, and retained even if the live systems have been rebuilt or wiped. This is the single most-commonly-missed obligation in real 7012 enforcement, because firms naturally want to clean up and move on; the clause requires them to keep the forensic state available for DoD inspection.
Does DFARS 7012 apply to commercial construction or federal civilian construction work?
No. DFARS 252.204-7012 is a Department of Defense clause and applies only to DoD prime contracts and subcontracts under DoD primes. Commercial construction work (private-sector developers, REITs, etc.), federal civilian construction (HUD, FAA non-classified, EPA, GSA most jobs), and state/local public construction don’t trigger DFARS 7012. Note that other federal agencies have analogous requirements, GSA’s CUI rules, NIST SP 800-171 application via FAR 52.204-21, but the specific DIBNet 72-hour reporting clause is DoD-only.