thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

DFARS 252.204-7012

Defense acquisition clause requiring contractors to safeguard covered defense information and report cyber incidents.

Definition

The clause requires implementing NIST SP 800-171, reporting cyber incidents to DoD within 72 hours via DIBNet, submitting malicious software, preserving images and data for at least 90 days, flowing down to subcontractors, and ensuring cloud providers meet FedRAMP Moderate or equivalent security. Reporting requires a DoD-approved medium assurance certificate.

Example

A contractor detects ransomware on a system with CUI and reports it on DIBNet within 72 hours.

Exam tip

Remember 72-hour reporting and 90-day image preservation.

Related terms