A DoD-Approved Medium Assurance Certificate is required to report a cyber incident. However, if you do not yet have a DoD-approved

A DoD-Approved Medium Assurance Certificate is required to report a cyber incident. However, if you do not yet have a DoD-approved Medium Assurance Certificate and need to report a cyber incident, please email DC3.DCISE@us.af.mill or call the DoD-Defense Industrial Base Collaborative Information Sharing Environment (DCISE) hotline at (410) 981-0104 for further assistance.

An brochure with more information about mandatory incident reporting can be found here. Page 3 of the document has information about DFARS Mandatory Reporting, DCISE Notification Requirements, and more.

DoD contractors shall report as much of the following information as can be obtained to DoD within 72 hours of discovery of any cyber incident involving covered defense information (CDI) systems or CDI information contained therein. Also, if any additional information is obtained after the initial Incident Collection Format (ICF) is submitted, you can select the initial ICF in your submission history and report any new or updated information via a follow-on ICF.

1. Company name
2. Unique Entity Identifier (UEI)
3. Facility CAGE code
4. Facility Clearance Level (Unclassified, Confidential, Secret, Top Secret, Not Applicable)
5. Contract Number (Procurement Instrument Identifier (PIID))
6. Company point of contact information (name, position, telephone, email)
7. U.S. Government Program Manager point of contact (name, position, telephone, email)
8. Contract number(s) or other type of agreement affected or potentially affected
9. Contracting Officer or other type of agreement point of contact (address, position, telephone, email)
10. Contract or other type of agreement clearance level (Unclassified, Confidential, Secret, Top Secret, Not Applicable)
11. Impact to Covered Defense Information
12. Ability to provide operationally critical support
13. Date incident discovered
14. Location(s) of compromise
15. Incident location CAGE code
16. DoD programs, platforms or systems involved
17. Type of compromise (unauthorized access, unauthorized release (includes inadvertent release), unknown, not applicable)
18. Description of technique or method used in cyber incident
19. Incident outcome (successful compromise, failed attempt, unknown)
20. Incident/Compromise narrative (Ex: Chronological explanation of event/incident, threat actor TTPs, indicators of compromise, targeting, mitigation strategies, and any other relevant information to assist in understanding what occurred)
21. Any additional information

See DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting for more information.

DoD Contractors shall report as much of the following information as can be obtained to the DoD within one business day of identifying or being notified by a subcontractor that a covered article was provided to the Government during contract performance.

1. Contract Number
2. Order Number(s), if applicable
3. Supplier Name
4. Brand
5. Model Number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number)
6. Item Description
7. Any readily available information about mitigation actions undertaken or recommended

See FAR 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities for more information.

See FAR 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment for more information.

1. Contract information to include contract number, USG Contracting Officer(s) contact information, contract clearance level, etc.
2. Contact information for the impacted and reporting organizations as well as the MCND
3. Details describing any vulnerabilities involved (e.g., Common Vulnerabilities and Exposures (CVE) identifiers)
4. Date/Time of occurrence, including time zone
5. Date/Time of detection and identification, including time zone
6. Related indicators (e.g., hostnames, domain names, network traffic characteristics, registry keys, X.509 certificates, MD5 file signatures)
7. Threat vectors, if known (see Threat Vector Taxonomy and Cause Analysis flowchart within the US-CERT Federal Incident Notification Guidelines)
8. Prioritization factors (e.g., functional impact, information impact, and recoverability as defined flowchart within the US-CERT Federal Incident Notification Guidelines
9. Source and Destination Internet Protocol (IP) address, port, and protocol
10. Operating System(s) affected
11. Mitigating factors (e.g., full disk encryption or two-factor authentication)
12. Mitigation actions taken, if applicable
13. System Function(s) (e.g., web server, domain controller, or workstation)
14. Physical system location(s) (e.g., Washington DC, Los Angeles, CA)
15. Sources, methods, or tools used to identify the incident (e.g., Intrusion Detection System or audit log analysis)
16. Any additional information relevant to the incident and not included above

See DFARS 252.239-7010 Cloud Computing Services for more information.

1. Company Name
2. Unique Entity ID (UEI)
3. Facility Commercial and Government Entity (CAGE) Code
4. Facility clearance (If Applicable)
5. Contract number(s), award date(s), submission number(s)
6. Order number(s)
7. Name of product or service provided to Government
8. Name of covered article subject to exclusion order
9. Name of vendor(s)
10. Brand of covered article
11. Model number of covered article
12. Item description
13. Mitigation actions
14. Time of item prohibition in relation to contract award

See FAR Subpart 4.23 Federal Acquisition Security Council and FAR 52.204-30 Federal Acquisition Supply Chain Security Act Orders--Prohibition for more information.

DIB participants are encouraged to VOLUNTARILY report information to promote sharing of cyber threat information and indicators that they believe are valuable in alerting the U.S. Government and others, as appropriate in order to better counter threat actor activity. Cyber activity other than compromises of covered defense information (CDI) or do not adversely affect the contractor's ability to perform operationally critical support may be of interest to the DIB and DoD for situational awareness purposes. Cyber threat activity recommended to be submitted as a voluntary report includes but is not limited to:

• Suspected APT activity
• Reconnaissance activities such as vulnerability scanning, exploitation attempts, etc.
• Threat actor infrastructure
• Network compromises NOT impacting DoD information
• Phishing email messages
• Suspicious files, activity, or network traffic

DFARS 252.204-7012 requires contractors to isolate and submit malicious files, if available, to DoD Cyber Crime Center (DC3) as part of the mandatory reporting requirements for cyber incidents. If you have a PKI certificate, you can get an Electronic Malware Submission (EMS) portal account where you will be able to submit malicious files and download the associated report once complete. Submit malicious files to EMS at https://ems.dc3on.gov. You may also request a DoD Safe link drop via emailing DC3.DCISE@us.af.mil and including your ICF number in the subject line, or by calling (410) 981-0104. DO NOT email malicious files to this email address.

DoD established the Defense Industrial Base (DIB) Cybersecurity (CS) Program to enhance and supplement DIB participants' capabilities to safeguard DoD information that resides on or transits DIB unclassified networks or information systems. This public-private cybersecurity partnership is designed to improve DIB network defenses, reduce damage to critical programs, and increase DoD and DIB cyber situational awareness. Under the DIB CS Program, DoD and DIB participants share unclassified and classified cyber threat information.

See 32 Code of Federal Regulations (CFR) Part 236, DoD's DIB Cybersecurity Activities for more information.

Learn more about the DoD's DIB Cybersecurity efforts  here (PDF).

Contact the DIB Cybersecurity Program: OSD.DIBCSIA@mail.mil, Hotline: (703) 604-3167, or Toll Free: (855) DoD-IACS

• Actionable information, mitigation, and remediation strategies
• Increases industry understanding of cyber threats as well as DoD's role
• Enables Participants to better protect unclassified defense information
• Engagement opportunities at many levels between USG and DIB from the C-suite to analyst level
• Indicators and threat products informed from DIB reporting, multiple USG data streams, and industry cyber threat reports
• Collaborative partnership with USG and more than 1,000 DIB Participant companies
• Bi-annual DIB Cybersecurity Summit, including topics on policy, operations, technology, architecture, and bi-annual Technical Exchanges
• Regional Partner Exchanges (RPEX)
• Working Groups for Small Business and Cybersecurity Best Practices
• One-on-One Meetings for Analyst to Analyst (A2A) and Business to Business (B2B)
• Malware analysis and Cyber Resilience Analysis (CRA)
• DCISE3 - A Free Advanced Threat Protection service to receive consolidated visibility into network traffic with cutting-edge threat intelligence integration. DCISE3 provides simple, timely, and fully automated approach to anonymous sharing and analysis of threat indicators.
• DIB-VDP - Leverages crowd-sourced white hat vulnerability researchers to identify vulnerabilities in DIB company internet-facing information systems that may otherwise have gone unnoticed and unmitigated.

Learn about DoD DIB Cybersecurity-as-a-Service (CSaaS) Services and Support by clicking  here (PDF).

Eligible DoD contractors may submit an application by clicking  here. Access to DoD's DIB Cybersecurity Program application requires a DoD-approved medium assurance certificate. For information on obtaining a DoD-approved medium assurance certificate, please visit http://public.cyber.mil/eca. Also note that the online application process will only permit one application account per company. The company applicant must be a U.S. citizen and authorized to act on behalf of the company during the application process.

To be eligible to participate in the Defense Industrial Base Cybersecurity Program, DoD contractors must:

• Handle DoD Controlled Unclassified Information (CUI) in support of a DoD contract, and
• Execute the standardized Framework Agreement (FA) with the Government.

More about the DIB CS Program application process can be found  here (PDF).

The DIB CS Program Framework Agreement has several Amendments available to qualifying participating companies. Learn more about the Subsidiary Amendment, International Business Unit Amendment, Third-Party Service Provider Amendment, and the Supply Chain Amendment in the  Amendment Fact Sheet (PDF).

The Manufacturing Overlay was created to help secure information systems supporting manufacturing processes and was developed through a partnership with cybersecurity experts from the Defense Industrial Base (DIB) Cybersecurity (CS) Program and USG. The Manufacturing Overlay is intended to complement (and further refine) existing security control baselines; further tailoring of controls may be required for systems with additional security or operational considerations.

•  Manufacturing Overlay (PDF)

The DIB Guide to Implementing the Cybersecurity Framework supports DoD's critical infrastructure responsibilities for the DIB. This Guide was developed working with our private sector partners to implement the Framework, while also incorporating the security requirements of NIST SP 800-171.

•  DIB Guide to Implementing the Cybersecurity Framework (PDF)
•  DIB Guide Template for Implementing Cybersecurity Framework (XLSX)

• 32 CFR Part 236: Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) Activities
• 32 CFR Part 2002: Controlled Unclassified Information (CUI)
• DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.239-7010: Cloud Computing Services
• DFARS 252.204-7018: Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services
• DFARS 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements
• FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders—Prohibition

Cybersecurity Maturity Model (CMMC)

• 32 Code of Federal Regulations, Part 170: Cybersecurity Maturity Model Certification (CMMC) Program
• CMMC Main Page
• CMMC 2.0 Program
• 5 Steps to Cybersecurity
•  Reporting NIST SP 800-171 Scores in SPRS (PDF)

Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

• DIBCAC Main Page

Supplier Performance Risk System (SPRS)

• SPRS Main Page
• SPRS Reference Material
•  SPRS Evaluation Criteria Manual (PDF)
• SPRS FAQs
•  Reporting NIST SP 800-171 Scores in SPRS (PDF)

NIST SP 800-171 Rev. 3: "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" provides federal agencies with recommended security requirements for protecting the confidentiality of CUI when the information is resident in nonfederal systems and organizations. The requirements apply to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. This publication can be used in conjunction with its companion publication, NIST Special Publication 800-171A, which provides a comprehensive set of procedures to assess the security requirements.

NIST SP 800-171 Rev. 2: "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations"

NIST SP 800-172: "Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171"

The DoD recognizes the need to help DIB organizations improve their cybersecurity posture and operational resilience and to help the DIB protect DoD information that resides on and transits DIB information systems. A variety of services are available based on your specific needs. Visit the websites below for information about cybersecurity training, services, and products. You may also contact the DIB CS PMO at OSD.DIBCSIA@mail.mil to request additional details about these services.

DoD Defense Industrial Base Collaborative Information Sharing Environment (DCISE)

For a more comprehensive look at DCISE service offerings, please see their brochure here.

DCISE3:

DCISE has partnered with a service provider to offer real-time monitoring of your organization's network traffic, threat detection, and alerts as well as the option to block malicious traffic.

This service includes real-time network traffic monitoring for malicious sources and destinations and shares data anonymously at no cost. Malicious traffic is alerted on and, if desired, blocked. The service protects against DDOS and DNS attacks.

Cyber Resilience Analysis (CRA):

This program offers a structured review of an organization's cybersecurity posture with the goal of understanding cybersecurity capabilities and operational resilience and improving the ability to manage risk to critical services and assets.

A structured survey conducted either in a DC3-facilitated session or as a self-assessment produces a report with suggested actions aligned with the 10 security domains that map to the NIST SP 800-171 requirements to protect CUI and the NIST Cybersecurity Framework.

Adversary Emulation (AE):

This program analyzes an organization's vulnerability to threat actors based on network architecture, software, and processes. It includes technical, process, and policy evaluations in a single, actionable framework.

AE may include penetration testing, network mapping, vulnerability scanning, phishing assessments, and web application testing.

DIB-VDP:

A voluntary program for DIB companies that provides vulnerability discovery triaging and validation. DIB-VDP researchers facilitate timely vulnerability remediation by the system owner to reduce risk. Leveraging the proven model is the most effective way to encourage vulnerability discovery with DIB companies' publicly accessible information systems.

Participation does not require DIB CS Program enrollment.

Email AFOSI.DC3.DIB-VDP@us.af.mil for more information.

National Security Agency (NSA) Cybersecurity Collaboration Center (CCC)

Protective Domain Name System (PDNS+):

The NSA's PDNS service combines commercial cyber threat feeds with the NSA's unique insights to filter external DNS queries and block known malicious or suspicious website traffic, mitigating nation-state malware, spear phishing, botnets, and more.

Attack Surface Management:

This service helps DIB customers find and fix issues before they become compromises by identifying DIB internet-facing assets, then leveraging commercial scanning services to find vulnerabilities or misconfigurations on these networks. Each customer receives a tailored report with issues to remediate, prioritized based on both severity of the vulnerability and whether or not it is being exploited.

Penetration Testing:

Leverages AI to automate pen-testing, enabling DIB companies to identify and mitigate vulnerabilities within their internal networks. The service also provides visualizations, tailored mitigation guidance, and the ability to verify if a DIB company has implemented the suggested mitigations effectively.

Threat Intelligence Collaboration:

Stay one step ahead of the adversary through NSA threat intelligence.

Visit: https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/ or email DIB_Defense@cyber.nsa.gov for more information.

Project Spectrum

Sponsored by the DoD Office of Small Business Programs (OSBP), Project Spectrum offers a wide variety of services, including cybersecurity information, resources, tools, and training. Their mission is to improve cybersecurity readiness, resiliency, and compliance for small and medium-sized businesses and the federal manufacturing supply chain.

Project Spectrum includes information about security, risk, and compliance assessments, readiness checks, training, reviews of tools, current research, and policy. Project Spectrum provides information about U.S. Government and commercial services and tools, both free and fee based.

Visit: https://www.projectspectrum.io/#/

Download the DoD Ransomware: Prevention and Protection slicksheet here. (PDF)

• Stop Ransomware Guide - Cybersecurity & Infrastructure Security Agency (CISA)
• Ransomware Protection and Response - National Institute of Standards and Technology (NIST)
• Internet Crime Complaint Center (IC3) - Federal Bureau of Investigation (FBI)
• #StopRansomware Guide (PDF) - Multi-State Information Sharing & Analysis Center (MS-ISAC)
•  DIB-Reported Cyber Threats - CY2023 Q1 (PDF) - DoD Cyber Crime Center (DC3)

• Accelerators: Entrepreneurship for Small Businesses (Formerly PTAP)
• CISA Cybersecurity Evaluation Tool (CSET)
• CISA Publication: Enhanced Visibility and Hardening Guidance
• Defense Pricing and Contracting (DPC)
• DoD Procurement Toolbox
• ND-ISAC: C3PAO Shopping Guide
• ND-ISAC: SMB Supply Chain Handbook (PDF)
• NSA CCC
• NSA: Securing Your Home Network
• NIST MEP
• CRWS-BOK Portal

This means that the primary contractor would like you to join the DIB CS Program, which is a voluntary public-private cybersecurity partnership in which Program participants share cyber threat information, mitigation, and remediation strategies. In order to learn more about the requirements to join the DIB CS Program click here.

If the primary contractor simply has a contract requirement to rapidly report cyber incidents, you can learn more about Reporting Cyber Incidents here.

A DoD-approved Medium Assurance Certificate is required to access these capabilities. To learn more about Medium Assurance Certificates, and to obtain one, please visit http://public.cyber.mil/eca You can also read more below.

If you do not yet have a DoD-approved Medium Assurance Certificate, please email the DoD-Defense Industrial Base Collaborative Information Sharing Environment (DCISE) DC3.DCISE@us.af.mil or call the DCISE hotline at (410) 981-0104 for further assistance.

Please DO NOT send any malicious files to the email address.

If the primary contractor simply has a contract requirement to rapidly report cyber incidents, you can learn more about Reporting Cyber Incidents here.

The DoD has established the External Certification Authority (ECA) Program to support the issuance of DoD-approved identification certificates to industry partners and other external entities and organizations. DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting requires contractors and subcontracts to obtain a DoD-Approved Medium Assurance Certificate in order to report cyber incidents. The ECA Program is designed to provide the mechanism for these entities to securely communicate with the DoD and authenticate to DoD Information Systems. To learn more about Medium Assurance Certificates and to obtain one, please visit http://public.cyber.mil/eca.

The DCISE hotline (410) 981-0104 operates 24/7. Normal, in-office operating hours for DoD-Defense Industrial Base Collaborative Information Sharing Environment (DCISE) are from 6:00 a.m. to 6:00 p.m. ET.

Mandatory incident reporting under DFARS 252.204-7012 Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting is required by most DoD contracts and in subcontracts that involve CDI and/or operationally critical support programs involving CDI. Contractors must report the discovery of cyber incidents that affect CDI information systems, or the CDI information residing therein, to https://dibnet.dod.mil within 72 hours of discovery. Malicious software, affected system images, packet capture, and other data relevant to the reported cyber incident must be preserved for 90 days to allow time for DoD to request the data in order to conduct a damage assessment or decline interest.

DFARS 252.204-7012 defines CDI as:

Any unclassified controlled technical information (CTI) OR other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is:

1. Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or
2. Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

Voluntary reporting is the primary channel for DIB Participants to share cyber threat information and indicators of compromise (IoCs) that may help the cybersecurity posture of other DIB Participants. Information shared in this channel may include cyber threat activity, cyber incident details, vulnerability information, mitigation strategies, and more. Cyber threat activity recommended to be submitted as a voluntary report includes but is not limited to:

• Suspected Advance Persistent Threat (APT) activity
• Compromise not impacting DoD information
• Targeted activity
• Vulnerability scanning and exploitation attempts
• Phishing email messages
• Suspicious files, activity, or network traffic

For more information, please click here.

No. The DIB CS Program is a voluntary information sharing initiative between private industry cleared defense contractors and the U.S. Government. All that is needed to report a cyber incident is possession of a DoD-approved Medium Assurance Certificate. To learn more about Medium Assurance Certificates, and to obtain one, please click here. To learn more about reporting a cyber incident, click here.

No. DFARS 252.204-7012 requires the impacted company to submit a report on the specific cyber incident. Additionally, if a sub-contractor experiences a reportable cyber incident, the sub-contractor is required to provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as possible.

A self-assessment that allows you to get a baseline of your cybersecurity resiliency is a valuable opportunity. The CRA will allow you to see where there are areas to improve and where you are already doing well. The practice areas and security domains in the CRA also map to the NIST 800-171 requirements for protection of CUI and the NIST Cybersecurity Framework.

We recommend maintaining your relationships with other agencies that you share information with and maintain any other contractual requirements you may have to share with other agencies. On the Incident Collection Format (ICF), there is also an area to let us know who else you've shared the information with. Per the DFARS 252.204-7012 clause, you do need to report any incidents involving Controlled Unclassified Information (CUI) to DCISE via the Mandatory Report ICF.

The U.S Government and law enforcement agencies have access to mandatory reporting. When it comes to the DIB CS Program however, voluntary reporting can only be shared with law enforcement with consent from the Partner.