Incident Response for CMMC: The 3.6 Family + the 72-Hour Rule

Two of the three incident-response controls are 5-pointers — and DFARS 252.204-7012 gives you just 72 hours to report a CUI incident. Set up DIBNet reporting before an incident, not during one.

Incident response is one of those areas small contractors skip because "we'll figure it out if it happens." CMMC doesn't allow that — and a separate DFARS clause adds a hard reporting deadline that can catch you off guard. Here's the 3.6 family and the rule that sits next to it.

72 hrReport window

3Controls (3.6 family)

2Are 5-point

What the 3.6 family requires

Control	In plain English
3.6.1 (5 pts)	Have a real incident-handling capability: prepare, detect, analyze, contain, recover, user response.
3.6.2 (5 pts)	Track, document, and report incidents to the right people — internal and external.
3.6.3	Test the capability so it actually works when it's real.

Two of the three are 5-pointers — the program weights "can you respond" and "do you report" heavily, because an unhandled or unreported incident involving CUI is exactly the outcome the rules exist to prevent.

The 72-hour rule most people miss

DFARS 252.204-7012 — the clause already in most DoW contracts that handle CUI — requires you to rapidly report a cyber incident to the Department of War within 72 hours of discovery, through dibnet.dod.mil. Reporting needs a Department of War-approved medium assurance certificate, which takes time to obtain — so the moment to set that up is before an incident, not during one. This obligation sits alongside CMMC 3.6.2, and missing it is its own problem.

A workable IR plan for a small contractor

You don't need a 24/7 SOC. A small team can satisfy 3.6 with a tight, real plan:

Step 1 · Write

The one-pager

Cover the lifecycle: prepare, detect, analyze, contain, recover, and user notification.

Step 2 · Prepare to report

Contacts + DIBNet cert

List internal and external contacts, and get the DIBNet medium assurance certificate now so you can file the 72-hour report.

Step 3 · Detect & test

Wire it in, run a tabletop

Tie in your EDR and log review, then run one tabletop — that single exercise satisfies 3.6.3.

Write a one-pager that covers the lifecycle — who does what during preparation, detection, analysis, containment, recovery, and user notification.
List your contacts in advance — internal decision-makers, your MSP/IT, and the external reporting paths (Department of War via DIBNet, law enforcement if applicable, your prime if required).
Get the DIBNet medium assurance certificate now so you can actually file the 72-hour report if you ever need to.
Wire detection into it — your EDR/monitoring (3.14.6) and log review (3.3.5) are what trigger the plan.
Run a tabletop — walk through a realistic scenario once, capture what broke, and fix the plan. That single exercise satisfies 3.6.3 and surfaces the gaps.

The fastest path to passing 3.6: a short documented plan, a pre-built contact + reporting list (including DIBNet), and one tabletop exercise on the calendar. See the full breakdowns in the Control Library.

Two of these are 5-point controls

See what incident response is worth to your SPRS score — run all 110 free.

Calculate your SPRS score →

Start here

Write the one-pager, build your contact + reporting list (get the DIBNet cert), tie in your monitoring, and run one tabletop. Score yourself, then document it. Both tools are free.