CMMC Incident Response and DFARS 252.204-7012 72-Hour Reporting

DFARS 252.204-7012 Essentials

• Safeguard covered defense information per NIST SP 800-171 Rev 2 (as applicable)
• Report cyber incidents to DoD within 72 hours of discovery
• Preserve and protect images of known affected systems and relevant monitoring data
• Cooperate with damage assessment activities

How CMMC IR Evidence Looks

• IR plan with roles, severity criteria, and 7012 reporting interface
• Detection sources (often SIEM) with on-call paths
• Tabletop or live exercise records
• Tickets showing escalation timestamps against the 72-hour rule

How CyberSilo Helps

• ThreatHawk detection and alert routing into IR workflows
• CSA evidence links for IR requirements and after-action artefacts
• We do not file your DoD reports for you — we help you prove the capability

Frequently Asked Questions

What is the DFARS 7012 reporting window?

Cyber incidents must be reported to DoD within 72 hours of discovery.

Does CMMC replace DFARS 7012?

No. CMMC assessment status and 7012 contractual safeguarding/reporting are related but distinct obligations.

Is Level 1 exempt from 7012?

7012 applicability depends on the clause in your contract and whether you handle covered defense information — not solely on CMMC level marketing.

Related CMMC Resources

CMMC hub · DFARS clauses · 14 domains · CSA