Active incident
The clock starts at discovery, not when you finish investigating.
Incident log
What the DoD report must include
File the actual report through the DoD DIBNet portal (dibnet.dod.mil). This tool tracks your response; it does not file for you.
Free cyber incident checklist for defense contractors. Prepare before it happens, track the 72-hour DFARS reporting clock when it does.