DFARS 252.204-7012 with ARRTECH
Records for the 72-hour incident report and what follows.
Records behind the 72-hour incident report
A useful incident report rests on a maintained record of discovery, affected systems and the evidence available. That same history supports follow-up as the contractor learns more.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| 7012 (c)(1)(i) | Review for evidence of compromise. | One search across supported sources. → |
| 7012 (c)(1)(ii) | Report within 72 hours. | A case record and report. → |
| 7012 (e) | Preserve monitoring data for 90 days. | Retention set per source. → |
| 7012 (f) | Give DoD access for forensic analysis. | A signed export DoD can verify. → |
Review
A SIEM can connect identity, host, network and application records during a compromise review, with relevant MITRE ATT&CK context. Preserve the original evidence and make gaps visible so the contractor can explain the scope of its findings.
Reporting
A dated case record helps the contractor prepare the required report within 72 hours of discovery. Record the available facts and decisions as the investigation develops.
Preservation
Preservation planning should cover the relevant monitoring data for at least the required 90-day period. Identify the sources and protect the retained records alongside any separate imaging and packet-capture work.
Access
A signed SIEM export gives forensic reviewers the activity records and material needed to verify their integrity. Source coverage and the incident history provide context for the follow-up investigation.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
7012 (e) images
System imaging is a separate forensic task. Preserve the required images alongside relevant monitoring and packet-capture data through the contractor’s incident process.
7012 (d)
Submit malicious software to DoD. The record comes from the contractor’s malware handling process.
7012 (m)
Flow the clause down to subcontractors through their contracts.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
7012 (c)(1)(i)
Conduct a review for evidence of compromise of covered defense information. Common event categories in a SIEM let reviewers search related activity across supported sources.
7012 (c)(1)(ii)
Rapidly report cyber incidents to DoD within 72 hours of discovery. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
7012 (e)
Preserve and protect images and relevant monitoring and packet capture data for at least 90 days. A SIEM can retain the relevant sources for the required period and make the history available for review.
7012 (f)
Provide DoD access to information and equipment for forensic analysis. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Questions
Does ARRTECH file the report?
No. The contractor reports to DoD, using the case record.
Does ARRTECH keep system images?
No. a SIEM keeps logs and does not image disks.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Is DFARS 7012 a certification?
No. It is a contract clause that binds the contractor.
Guide
What is DFARS 252.204-7012?
A DoD contract clause that requires adequate security for covered defense information and rapid reporting of cyber incidents.
What is covered defense information?
Unclassified controlled technical information or other CUI provided to or developed by a contractor for DoD.
What does the 72-hour rule require?
A report to DoD within 72 hours of discovering a cyber incident, then preserved data and forensic access on request.
How ARRTECH takes care of DFARS incident reporting
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
