Incident response retainer
Incident response retainer, built for the DFARS 72-hour clock.
When a cyber incident touches covered defense information, you have 72 hours to report it to DoD, and you have to file the report yourself. A Cyberuptive retainer means the investigation, evidence, and draft report are ready before that clock runs out.
The short answer: you file, we get you ready to file
If you hold a DoD contract with DFARS 252.204-7012, you must report any cyber incident that affects covered defense information to DoD at dibnet.dod.mil within 72 hours of discovery (DFARS 252.204-7012). The report has to come from your company. The DoD Cyber Crime Center (DC3) is direct about this: a vendor or customer cannot file a mandatory report on your behalf, because the clause "requires the impacted company to submit a report" (DC3).
That's the part most MSSP contracts leave vague. A good incident response partner does the investigation, builds the timeline, collects the indicators, and drafts every field of the report. Your company submits it using your own DoD-approved medium assurance certificate. If nobody at your company has that certificate when an incident starts, you're already behind.
What DFARS 252.204-7012 requires after an incident
The clause is short, but each paragraph is a separate job. Here's how the work splits between you and a retained responder.
| Requirement | What the clause says | Who does the work |
|---|---|---|
| Review for compromise, (c)(1)(i) | Identify compromised computers, servers, data, and user accounts, including other systems that may have been reached | Responder leads; you provide access and approvals |
| Report within 72 hours, (c)(1)(ii) | Rapidly report to DoD at dibnet.dod.mil | Responder drafts; you submit |
| Medium assurance certificate, (c)(3) | Contractor or subcontractor must have or acquire one to report | You, before any incident |
| Malicious software, (d) | Submit isolated malware to DC3, not to the contracting officer | Responder isolates and packages; submitted through DC3's malware portal |
| Media preservation, (e) | Keep images of affected systems and packet capture for at least 90 days after the report | Responder captures; you retain |
| Forensic access, (f) | Give DoD access to additional information or equipment on request | Joint |
| Subcontractor flow-down, (m)(2)(ii) | Give the DoD-assigned report number to your prime or next higher tier | You |
Source: DFARS 252.204-7012 paragraphs (c) through (m).
DC3 publishes the fields it expects in the Incident Collection Format, from your UEI and CAGE code to the incident narrative, affected contracts, and the technique used (DC3). Many of those fields are contract details, not technical ones. Collecting contract numbers and contracting officer contacts at hour 60 is how deadlines get missed.
Before you need it
Get your 72-hour reporting kit in place now
A retainer onboarding confirms who holds your medium assurance certificate, where your evidence lives, and who approves containment, so none of that gets figured out in the middle of an incident.
- Medium assurance certificate check
- Pre-approved containment actions
- 90-day evidence preservation plan
- Prime-contractor notification template
How a Cyberuptive retainer works
A retainer is an agreement you sign before an incident, so the legal, access, and scope questions are settled while things are calm. Ours is built around the DFARS clock.
- Onboarding before any incident. We map your CUI boundary and covered contractor information systems, confirm who holds your medium assurance certificate, collect the contract data the report needs, and document which containment actions we can take without waking anyone up.
- Activation. Call the number in your runbook. Incident response engagements for confirmed breaches begin within one business hour of retainer activation.
- Investigation and containment. Host isolation, credential revocation, and account disablement under pre-approved rules, then scoping for what was touched.
- Report package. A completed draft of the DIBNet report, a timeline, indicators, and the malware package, handed to your authorized submitter with enough time to review it.
- Evidence handling. Forensic images and packet captures preserved for at least 90 days from submission, with chain of custody documented.
- After action. Root cause, fixes, SSP and POA&M updates, and an honest check of whether your SPRS score still reflects reality.
For CMMC-scoped clients, incident work is done by US-persons responders on our segregated US SOC. If you already use the Cyberuptive 24/7 SOC or managed detection and response, the retainer picks up where the SOC's triage ends, with no handoff to a stranger.
Not a defense contractor? The same model applies
The 72-hour DFARS window is one of several. Coast Guard-regulated vessels and facilities report cyber incidents to the National Response Center under 33 CFR Part 101, Subpart F. Hawaii businesses have breach notification duties under HRS Chapter 487N. EU customers may pull you into NIS2 timelines. We write your runbook around every clock that applies to you, and we check your MSSP contract terms against them. See whether your MSSP contract gives you enough time.
What to have ready before you sign anyone
Whether you retain us or someone else, confirm these five things now:
- A named person at your company holds a current DoD-approved medium assurance certificate (DoD Cyber Exchange ECA program).
- A list of every contract carrying DFARS 252.204-7012, with contracting officer contacts.
- Log retention long enough to reconstruct what happened. NIST SP 800-171 audit requirements and the 90-day preservation rule both depend on it.
- Written authority for your responder to isolate hosts and disable accounts.
- A tested phone tree that includes your prime contractor and your cyber insurer.
Frequently asked questions
Who files the DFARS 72-hour cyber incident report?
The affected contractor does. DFARS 252.204-7012(c) requires the contractor to rapidly report to DoD at dibnet.dod.mil, and the DoD Cyber Crime Center (DC3) states that a third party cannot submit a mandatory report on another company's behalf. Your MSSP or incident response firm investigates and drafts the report content; someone at your company with a DoD-approved medium assurance certificate submits it.
When does the 72-hour clock start?
At discovery. DFARS 252.204-7012 defines "rapidly report" as within 72 hours of discovery of any cyber incident that affects a covered contractor information system, the covered defense information on it, or your ability to perform operationally critical support.
What if we don't have a medium assurance certificate yet?
Get one before you need it; the clause requires contractors and subcontractors to have or acquire one. If you have an incident and no certificate, DC3 directs you to email DC3.DCISE@us.af.mil or call the 24/7 DCISE hotline at (410) 981-0104 for help.
How long do we have to keep evidence after an incident?
At least 90 days from submitting the report. DFARS 252.204-7012(e) requires you to preserve images of known affected systems and relevant monitoring and packet capture data so DoD can request it or decline interest.
We're a subcontractor. Who do we tell?
Report to DoD through DIBNet yourself, then give the DoD-assigned incident report number to your prime contractor (or the next higher-tier subcontractor) as soon as practicable, per DFARS 252.204-7012(m)(2)(ii).
How fast does Cyberuptive start on a confirmed breach?
Incident response engagements for confirmed breaches begin within one business hour of retainer activation. Clients who also use the Cyberuptive 24/7 SOC get triage and pre-authorized containment in the same session the alert fires.
Does the CMMC Phase 2 pause change incident reporting?
No. The July 13, 2026 suspension paused third-party CMMC certification. DFARS 252.204-7012, including incident reporting, media preservation, and forensic access, still applies to contracts that include the clause.
Aloha, let's talk
Don't meet your IR team during the incident.
A 30-minute scoping call covers your contracts, your CUI boundary, and who files what. You get a fixed-scope retainer proposal within one business week.
Further reading
Analysis from the team that runs the SOC.