DoD Urges Quick Cyber Incident Reports from Defense Contractors
Published Date: 1/14/2026
Notice
Summary
If you’re a business working with the Department of Defense, you need to report any cyber incidents and cloud computing issues quickly. This update reminds contractors about the rules and asks for public comments by January 14, 2026. Reporting helps keep defense info safe, and it usually takes less than half an hour per report.
Analyzed Economic Effects
4 provisions identified: 0 benefits, 4 costs, 0 mixed.
Mandatory DoD Cyber Incident Reporting
If you do business with the Department of Defense, you must report cyber incidents that affect covered contractor information systems, covered defense information, or your ability to perform work designated as operationally critical support. The notice lists 1,971 affected respondents, about 16,223 annual responses, an average burden of 0.42 hours per response, and a total annual burden of 6,770 hours; DoD will accept comments through January 14, 2026.
Must Explain Deviations from NIST SP 800-171
If you propose in a solicitation to vary from any National Institute of Standards and Technology (NIST) Special Publication 800-171 security control, you must submit a written explanation to the contracting officer saying why the control is not applicable or what alternative protects the information.
Cloud Use Representation Requirement
Offerors must state in a solicitation whether they "anticipate" or "do not anticipate" using cloud computing services in contract performance; this representation notifies contracting officers whether DFARS cloud requirements may apply.
Cloud Services Cyber Incident Reports Required
When DoD purchases cloud computing services, the DFARS cloud clause (252.239-7010) requires reporting cyber incidents that occur within those cloud services. Contractors providing cloud services to DoD must submit those cyber incident reports as required by the clause.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Related Federal Register Documents
2026-09067, Defense Federal Acquisition Regulation Supplement: Mitigating Risks Related to Foreign Ownership, Control, or Influence (DFARS Case 2021-D011)
The Department of Defense is updating rules to make sure companies working with them reveal if they’re owned or controlled by foreign folks. This helps keep our defense projects safe from hidden foreign influence. If you’re a contractor or subcontractor, get ready to share ownership info by July 6, 2026, or risk delays in your contracts.
2026-09038, Defense Federal Acquisition Regulation Supplement: Disclosure of Greenhouse Gas Emissions (DFARS Case 2024-D021)
Starting May 7, 2026, the Department of Defense won’t make most new defense contractors share their greenhouse gas emissions unless it’s really needed for the contract. This change helps nontraditional contractors avoid extra paperwork, but DoD can still ask for info if it’s directly tied to the job. It’s a smart move to keep things fair and focused without slowing down important defense work.
2026-16682, Information Collection Requirement; Defense Federal Acquisition Regulation Supplement (DFARS), DoD Mentor-Protégé Program
The Department of Defense wants to keep collecting info for its Mentor-Protégé Program, which helps businesses team up and grow. This extension affects about 96 businesses and won’t cost extra but asks for feedback by October 16, 2026. The goal is to make sure the info collected is useful and easy to provide for the next three years.
2026-15545, Information Collection Requirement; Defense Federal Acquisition Regulation Supplement, Contract Pricing
The Defense Acquisition Regulations System has submitted to OMB for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.
2026-15544, Information Collection Requirement; Defense Federal Acquisition Regulation Supplement (DFARS) Part 204, Administrative Matters, and Related Clause at 252.204; OMB Control Number 0704-0225
The Defense Acquisition Regulations System has submitted to OMB for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.
2026-15548, Information Collection Requirement; Defense Federal Acquisition Regulation Supplement (DFARS), Contract Financing
The Defense Acquisition Regulations System has submitted to OMB for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.
Previous / Next Documents
Previous: 2026-00542, Notice of Intent To Request Revision and Extension of a Currently Approved Information Collection
The USDA’s National Agricultural Statistics Service plans to update and extend its Objective Yield Surveys, which help predict crop production for things like corn, soybeans, and nuts. Farmers and others involved in agriculture will keep sharing info through these surveys, which guide important crop reports. Comments on these changes are welcome until March 16, 2026, and the update will last for three more years with no new costs announced.
Next: 2026-00546, Office of the Director, National Institutes of Health; Notice of Meeting
The National Institutes of Health (NIH) is holding a virtual meeting on January 29, 2026, to discuss a plan to reorganize part of their office by creating two new teams focused on research innovation and economics. This affects researchers and the public, who can share their thoughts by January 26. The meeting also includes a private session to review grant applications, which could impact future funding decisions.