Defense contractors reporting a cyber incident on a covered system will continue to work with the familiar 72-hour window under DFARS 252.204-7012, not the tighter 8-hour deadline DoD floated in an earlier proposal. A stricter 8-hour reporting requirement drew significant industry pushback for being too fast to allow contractors to confirm whether an event actually qualifies as a reportable incident and gather accurate information before reporting. As part of the Revolutionary FAR Overhaul rulemaking that reached the Federal Register in June 2026, DoD reverted the reporting clock to 72 hours, aligning DFARS 7012 with the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) reporting framework.
Why the 8-Hour Proposal Didn't Survive
Contractors and industry groups argued that an 8-hour window was operationally unworkable: incident response teams often need more than 8 hours simply to determine whether a security event rises to the level of a reportable "cyber incident" under DFARS's definitions, let alone to gather the specific facts DoD's reporting form requires. Reporting prematurely — before an incident is fully understood — risks flooding DoD's Cyber Crime Center with false positives or inaccurate initial reports that later need correction. The 72-hour standard, in place since DFARS 7012's original "rapid report" requirement, gives contractors enough time for triage while still meeting DoD's need for timely visibility into the defense industrial base's threat picture.
What Actually Changed in June 2026
The June 2026 rulemaking harmonizes DFARS incident reporting timelines with CIRCIA rather than shortening them further — the 72-hour standard now applies consistently across both security-prohibition reports and CUI incident reports covered by DFARS 7012. For contractors, this means no new operational burden: the reporting process and timeline that has governed DFARS cyber incident reporting for years remains in place.
What It Means for Contractors
Contractors should treat this as confirmation, not change: the 72-hour "rapid report" clock under DFARS 252.204-7012 remains the operative standard, and any internal incident-response playbooks built around a shorter 8-hour deadline should be reverted. Contractors that had already begun re-tooling their incident response processes for an 8-hour reporting window can stand down that specific effort, though the underlying discipline of triaging incidents quickly remains good practice regardless of the regulatory deadline. Contractors should still confirm the current text of DFARS 252.204-7012 and any related class deviations before finalizing their own incident-response documentation, since further DFARS/FAR Overhaul rulemaking is ongoing through 2026.
