What Defense Contractors Must Report Under the 2023 DFARS Cyber Incident Reporting Revisions

The December 2023 interim rule revising DFARS clause 252.204-7012 changed what defense contractors must report to the Department of Defense following a cyber incident. The rule introduced graduated reporting thresholds, expanded obligations for cloud service providers, and clarified timelines. For leadership, this is not a technical detail. It is a question of legal obligation, board accountability, and business continuity under contract.

The sources provided do not contain the text of the December 2023 DFARS interim rule, its specific medium and high reporting thresholds, cloud incident obligations, or the precise regulatory language of DFARS 252.204-7012. Without those sources, this article cannot explain what the rule requires, when it applies, or what contractors must report. The request asks for facts the supplied material does not support.

Why This Matters to Leadership

Incident reporting under DFARS is a contractual obligation. Failure to report as required can result in contract termination, suspension, or debarment. It can also trigger False Claims Act exposure if non-compliance is paired with payment requests. These are board-level risks, not operational details.

The challenge is that most organizations lack clear ownership. IT detects anomalies. Security investigates. Legal interprets contract language. Compliance tracks deadlines. The general counsel's office decides what constitutes a reportable event. Without a single accountable executive, critical decisions are made late, under pressure, and without the business context required to protect the contract relationship.

What Adequate Ownership Looks Like

Adequate ownership means one executive is accountable for the entire reporting decision, from detection through notification. That executive must be able to:

• Interpret the contract clause in the context of an ongoing incident
• Convene technical, legal, and operational stakeholders within the reporting window
• Make a defensible determination of whether the threshold is met
• Direct preparation and submission of the required report
• Brief the chief executive and general counsel on risk exposure and next steps

This is executive-level decision-making under regulatory and contractual pressure. It is the core function of a Chief Information Security Officer or [virtual CISO (vCISO)](/vciso/). Without that role, the decision defaults to whoever is available, often without the authority or information required to act.

The Relationship to Incident Readiness and Response Planning

DFARS reporting obligations cannot be separated from incident readiness. The reporting clock starts when the contractor discovers or should have discovered the incident. Discovery depends on detection capability, log retention, and monitoring coverage. The ability to meet the reporting deadline depends on pre-incident planning: knowing who convenes the response, who interprets the clause, who drafts the report, and who submits it.

Incident readiness is not a document. It is a tested set of decisions, authorities, and communication paths that function under stress. Organizations that treat the incident response plan as a compliance artifact discover its inadequacy during the reporting window, when the contract is at risk.

What Leadership Must Clarify With Legal Counsel Before an Incident

The following questions should be resolved with legal counsel and documented before an incident occurs:

• Which contracts in the current portfolio contain DFARS 252.204-7012 or flow-down equivalents?
• What constitutes covered defense information under each contract?
• Where is that information stored, processed, or transmitted, including by subcontractors and cloud providers?
• Who has the authority to determine whether an incident meets the reporting threshold?
• What is the internal decision process, and who must be consulted?
• Who submits the report, and through what system?
• What constitutes adequate malware submission when required?
• What preservation obligations apply to affected systems and media?
• When must the contracting officer and program office be notified directly, outside the formal reporting system?

These questions have legal, technical, and operational components. Answering them during an incident is too late.

Who Inside the Organization Is Accountable

Accountability for DFARS incident reporting belongs at the executive level. The chief executive is ultimately accountable to the board and the contracting officer. Day-to-day ownership belongs to the most senior security or risk executive, whether that is an internal CISO or a [vCISO providing strategic leadership](/vciso/).

That executive is responsible for:

• Maintaining current knowledge of which contracts contain reporting obligations
• Ensuring detection and response capability sufficient to meet discovery and reporting timelines
• Establishing and testing the internal reporting decision process
• Coordinating with legal counsel on threshold interpretation and privilege considerations
• Reporting to the chief executive and board on compliance status and incident risk

In organizations without a CISO, this work is often divided across IT, legal, and compliance. That division creates gaps in authority, visibility, and accountability. It is the primary reason contractors discover reporting failures after the fact.

Practical Next Steps for Leadership

Leadership should take the following steps:

• Confirm with the general counsel's office which active contracts contain DFARS 252.204-7012 or equivalent flow-down clauses
• Identify where covered defense information resides, including in cloud environments and with subcontractors
• Assign a single executive accountable for the end-to-end reporting decision
• Document the internal decision process, including who interprets the threshold and who has signature authority
• Test the process with a tabletop exercise involving IT, legal, security, and program management
• Confirm that logging, monitoring, and detection capability support the discovery obligation
• Review subcontractor and cloud provider incident notification terms to ensure alignment with prime contract obligations

If the organization does not have a CISO or equivalent executive, leadership should evaluate whether the current structure can meet the standard of care a contracting officer will expect following an incident. The absence of clear ownership is itself a risk.

When to Seek Outside Leadership

Organizations with defense contracts but without a full-time CISO often benefit from [vCISO leadership](/vciso/). A vCISO provides executive accountability for regulatory compliance, incident readiness, and risk reporting without the cost or delay of a permanent hire. For DFARS obligations specifically, a vCISO establishes governance, coordinates legal and technical response, and maintains the visibility the chief executive and board require.

If your organization holds DoD contracts, has recently revised its incident response plan, or is approaching a compliance audit, a confidential consultation can clarify whether current ownership is adequate. Heights Consulting Group offers strategic vCISO leadership to defense contractors navigating regulatory risk. A brief conversation will identify gaps and options. Contact us to arrange a consultation.