Also known as: DFARS 7012 · Safeguarding Covered Defense Information and Cyber Incident Reporting
The DoD contract clause that requires defense contractors to safeguard sensitive information and report cyber incidents within 72 hours.
DFARS 252.204-7012, titled "Safeguarding Covered Defense Information and Cyber Incident Reporting," is a Department of Defense contract clause (codified at 48 CFR 252.204-7012) that applies to contractors and subcontractors whose systems store, process, or transmit Covered Defense Information (CDI) — a category that includes Controlled Unclassified Information (CUI). It requires the contractor to provide "adequate security" on covered information systems by implementing the security requirements in NIST Special Publication 800-171, to report any cyber incident to the DoD within 72 hours of discovery through the reporting portal at https://dibnet.dod.mil, and to preserve affected media for DoD review. Under paragraph (m), the clause must be flowed down without alteration into subcontracts that involve covered defense information or operationally critical support.
Source: DFARS 252.204-7012 (eCFR, 48 CFR 252.204-7012)
Within 72 hours of discovery of any cyber incident, reported to the Department of Defense through the DIBNet portal at https://dibnet.dod.mil.
Yes. The clause must be included, without alteration, in subcontracts that involve covered defense information or provide operationally critical support — so subcontractors carry the same safeguarding and reporting duties.
Definitions are educational and may be modified by your specific policy language, endorsements, and state rules. For regulatory guidance, refer to the California Department of Insurance or the NAIC.
Last updated: July 2026.