Clear Path step · Business · Your industry's rules and risks
Be ready to report a cyber incident to DoD
Why it matters: DFARS 7012 requires rapid reporting and preservation of evidence. Getting the certificate during an incident is too late.
On your path if you picked “Government contractor” for “What's your industry?”.
Do it
- Obtain a medium assurance certificate for the person who will report.
- Add DIBNet reporting to your incident plan.
- Set log retention and know how to preserve system images.
- Include subcontractor reporting in your flow-down terms.
Check it worked: You have a DoD-approved medium assurance certificate for reporting through DIBNet, know who files, and know how to preserve images and logs.
Simply put
It's like renewing your passport before you book the trip. You need the certificate to report to the Defense Department, and the reporting clock starts at discovery, so you get it now rather than during an incident.
In detail
The reporting clock in DFARS 7012 starts at discovery, so define 'discovery' in your plan and practice the handoff to whoever files.
Points toward the Long View: a reporting handoff practiced well before the clock ever starts.