3.6.2 — Track and Report

The One-Liner

If a cyber incident affects CUI and you don’t report to DoD via DC3/DCISE within 72 hours, you’ve violated your DFARS contract.

What It Says

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

What It Actually Means

Every incident — from a phishing attempt to a confirmed breach — must be tracked, documented, and reported to the right people. Three activities:

1. Track. Every incident is logged in a ticketing system or incident tracker with: what happened, when it was detected, severity, affected systems, CUI impact assessment, actions taken, current status, and resolution. The incident lives in the tracker from detection through closure.

2. Document. Each incident has a record that captures the full lifecycle: initial detection, analysis findings, containment actions, recovery steps, and lessons learned. Evidence is preserved — screenshots, log exports, forensic images where applicable.

3. Report. Internal: notify the people who need to know based on severity — IT management, executive leadership, legal, and the prime contractor. The plan names a specific role responsible for communicating about the incident to internal and external stakeholders — not whoever happens to be free. External: for incidents involving CUI, report to DoD (DC3/DCISE) within 72 hours of discovery per DFARS 252.204-7012 — file through the Incident Collection Format (ICF) portal at icf.dcise.cert.org, which produces an XML you transmit to DC3 via encrypted email or DoD SAFE; DC3/DCISE then assigns the incident report number. (DIBNet was decommissioned 6 June 2025; the 7012 clause text still names dibnet.dod.mil, which now redirects to DC3/DCISE.) The 72-hour clock starts at discovery, not at confirmation. Reporting isn’t limited to network intrusions — mishandling or unauthorized disclosure of CUI is reportable through your contract channels too. A paper spill is still an incident.

DFARS 252.204-7012 — What the Clause Requires

Filing the DC3/DCISE report is only part of the clause. When you discover a cyber incident, 7012 also obligates you to:

• Review for compromise — 7012(c)(1)(i). Investigate for evidence of compromise: identify which computers, servers, specific data, and user accounts were affected, and analyze other systems on the network the attacker may have reached.
• Preserve evidence for 90 days — 7012(e). Capture and protect images of all known affected systems plus relevant monitoring and packet-capture data, and hold them for at least 90 days from the date you submit the report so DoD can request the media or decline it.
• Submit malware to DC3 — 7012(d). Any malicious software you isolate in connection with a reported incident goes to the DoD Cyber Crime Center (DC3) per its instructions — never to the Contracting Officer.
• Support forensics and damage assessment — 7012(f), (g). DoD may request access to additional information or equipment for forensic analysis, and information to support its damage assessment.

Reporting through DC3/DCISE requires a DoD-approved medium assurance certificate. Obtain it before you need it — you can’t file at hour 70 while still waiting on the certificate.

---

Pass or Fail

Your assessor needs a “yes” to every row:

#	Question	What “yes” looks like
1	Are incidents tracked?	Incident tracking system with entries from detection through closure
2	Are incidents documented?	Incident records with timeline, actions, evidence, and resolution
3	Are external reporting authorities identified?	DoD Cyber Crime Center (DC3) identified as recipient; DC3/DCISE portal access verified; 72-hour procedure documented
4	Are internal officials identified?	Escalation matrix: who is notified at each severity level
5	Are external authorities notified?	Evidence of DC3/DCISE reporting for past CUI incidents (or documented procedure if no incidents have occurred)
6	Are internal officials notified?	Internal notification records for past incidents

---

What to Have Ready on Assessment Day

Documents they’ll review: Incident response policy; incident tracking records; incident documentation; internal notification records; DC3/DCISE reporting procedures; DC3/DCISE portal access evidence; escalation matrix

People they’ll talk to: Personnel with incident monitoring and reporting responsibilities; management who receive incident notifications; personnel with DC3/DCISE reporting responsibility

Live demos they’ll ask for: “Show me your incident tracking system.” “Walk me through a past incident record.” “Show me your 72-hour reporting procedure and DC3/DCISE access.”

---

The Assessor’s Playbook

These are the actual questions. Have answers ready.

• “Show me your incident tracking system. Walk me through a recent entry.”
• “Who gets notified internally when an incident is detected? Show me the escalation matrix.”
• “How do you report to DoD via DC3/DCISE? Show me the procedure and DC3/DCISE access.”
• “When does the 72-hour clock start? Who is authorized to file the report?”
• “Show me documentation from a past incident — or your template if you haven’t had one.”

Real-World Example

A defense contractor tracks incidents in their ITSM ticketing system with a dedicated “Security Incident” category. Each ticket captures: detection timestamp, source (SIEM alert, user report, EDR), affected systems, CUI impact assessment (yes/no/unknown), severity level, assigned responder, timeline of actions, evidence attachments, and resolution. The internal escalation matrix: Low/Medium → IT Security Lead + IT Manager within 4 hours. High → add CEO within 2 hours. Critical (CUI breach) → full IR team + attorney within 1 hour, 72-hour DC3/DCISE clock starts. The IT Security Lead has DC3/DCISE portal credentials and the DC3/DCISE reporting procedure is a step-by-step checklist in the IR plan. Even though the company hasn’t had a CUI incident, they verify DC3/DCISE access annually and have a pre-filled reporting template ready. The assessor reviews the tracking system, the escalation matrix, and the DC3/DCISE reporting procedure.

---

Where Companies Trip Up

No incident log. Incidents are handled but not tracked. The assessor asks “show me your incident records” and there are none. Use a ticketing system — even a dedicated spreadsheet — but track everything.

No 72-hour awareness. The IR team doesn’t know about the DFARS 252.204-7012 reporting requirement or has never accessed DC3/DCISE. Train the team, obtain the DoD-approved medium assurance certificate DC3/DCISE requires, verify portal access annually, and include the procedure in the IR plan.

Internal only. Incidents are handled and reported internally but the external reporting requirement is ignored. DC3/DCISE reporting is a contractual obligation for CUI incidents.

No evidence preservation. Incidents are resolved but logs, screenshots, and forensic evidence aren’t preserved. Document as you go — evidence is needed for DC3/DCISE reporting and lessons learned.

---

How to Talk About This

To a CEO or Board

Every incident is tracked from detection through resolution. For CUI incidents, we report to the DoD within 72 hours as required by our contract. Internal stakeholders are notified based on severity within hours.

To an Engineering Team

Incident tracking in ITSM with Security Incident category. Escalation: Low/Med → 4h, High → 2h + CEO, Critical → 1h + full team + attorney. DC3/DCISE: medium assurance certificate obtained ahead of need; 72h clock from discovery, portal access verified annually, pre-filled template ready. Evidence preserved: log exports, screenshots, forensic images. Post-incident review within 2 weeks.

---

Connected Requirements

Requirement	Why it matters here
3.6.1 — Have a Plan	The IR plan that establishes the capability this requirement exercises
3.6.3 — Test the Plan	Testing validates that tracking and reporting procedures work
3.3.6 — Search and Report	On-demand log queries support incident investigation and documentation