ThreatKrusher Emblem
ThreatKrusher Assurance Center
🔍 ⌘K
Assurance Center > MSSP Defense Additions > DFARS 72-Hour Reporting Protocol
Search Results
Sanitized Public Standard Ref: ETP-AC-STD-025 Ver: 1.0.0 Owner: Incident Response Commander & FSO
⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Operational procedure ensuring DFARS 252.204-7012 compliant cyber incident reporting to the DoD DIBNet portal within 72 hours.

eTrepid DFARS 252.204-7012 72-Hour Incident Reporting Protocol

Governing Standard: DFARS 252.204-7012 (c) / NIST SP 800-171 3.6

1. Statutory Mandate

Under DFARS clause 252.204-7012(c), defense contractors and subcontractors discovering a cyber incident that affects a covered defense information system, covered defense information (CDI), or the contractor's ability to provide operationally critical support must report the incident to the Department of Defense (DoD) within 72 hours of confirmation.

This protocol codifies eTrepid's rapid forensic investigation, evidence preservation, and reporting support procedures.

2. 72-Hour Incident Reporting Timeline

flowchart TD

T0["Hour 0: Incident Confirmation (ThreatKrusher SOC Detection)"] --> T12["Hour 12: Scoping & Forensic Media Image Capture"]

T12 --> T24["Hour 24: CDI / CUI Impact Assessment & Prime Contractor Briefing"]

T24 --> T48["Hour 48: Draft DoD Incident Collection Form Preparation"]

T48 --> T72["Hour 72: Formal Submission to DoD Cyber Crime Center (DC3)"]

2.1 Phase 1: Rapid Forensic Containment (Hours 0 - 12)

  • Confirmation by ThreatKrusher Incident Commander.
  • Forensic preservation of volatile system memory and disk images adhering to NIST SP 800-86 forensic standards.

    • 2.2 Phase 2: CDI Impact Verification (Hours 12 - 36)

  • Determination of whether Covered Defense Information or Controlled Technical Information was accessed, exfiltrated, or corrupted.
  • Identification of impacted DoD contract numbers, CAGE codes, and subcontract tiers.

    • 2.3 Phase 3: DC3 Submission (Hours 36 - 72)

  • Secure submission of the Cyber Incident Report through the DoD DIBNet portal (`dibnet.dod.mil`) utilizing a valid DoD-approved Medium Assurance Certificate (ECA).
  • Transmittal of required reporting data elements (contract numbers, technical summary, indicators of compromise, and affected system details).

    • 3. Media Preservation Obligations

    In accordance with DFARS 252.204-7012(e), eTrepid and the customer retain all forensic images, packet captures, and audit logs of affected systems for a minimum of 90 days following report submission, allowing DoD forensic investigators access if requested.

    ← Previous (MSSP Defense Additions)ThreatKrusher 24/7 SOC CharterNext (MSSP Defense Additions) →MSSP Multi-Tenant Isolation