The proposed federal CUI regulations introduce a 72-hour breach reporting requirement for most civilian agencies. If your team handles Controlled Unclassified Information (CUI) as a federal contractor, you need a documented incident response process ready before the final rule is implemented.
This template provides a structured reporting workflow you can adapt to your contract requirements. It's designed around the 72-hour timeline and NIST SP 800-171 incident response principles.
Purpose of the Template
Use this template when your team discovers unauthorized access to CUI, such as a ransomware attack, an insider data leak, a lost laptop with unencrypted files, or a misconfigured S3 bucket. It guides your internal triage, determines what you report to the agency, and documents your response for audits.
This template doesn't replace reading your contract's specific reporting clause. Different agencies may have different points of contact, and DoD contractors already follow DFARS 252.204-7012 with its own reporting mechanics. However, the core 72-hour civilian agency timeline and the types of information you'll need to collect are consistent.
Prerequisites
Before customizing this template, ensure:
CUI Identification: If you can't identify CUI in your environment, this template won't help. Review Executive Order 13556 and the CUI Registry. Look for agency markings, contract clauses referencing CUI, and data types like Social Security numbers or critical infrastructure vulnerability assessments.
Reporting Point of Contact: Check your contract for the agency-specific contact. Some contracts route through a contracting officer; others may specify a security or program office. The proposed rule doesn't centralize reporting like CIRCIA does for critical infrastructure incidents reported to CISA.
Access to System Logs: You can't report unauthorized access if you don't know when it happened or what was affected. At a minimum, you need audit logging per NIST SP 800-171 requirement 3.3.1.
Subcontractor Flow-Down Understanding: If you pass CUI to subcontractors, they're subject to the same rules. You need a mechanism to receive incident reports from them within your 72-hour window.
The Template
CUI INCIDENT REPORTING WORKFLOW
PHASE 1: DISCOVERY AND INITIAL TRIAGE (Hour 0-4)
□ Incident detected by: [monitoring tool / user report / third party / other]
□ Date and time of discovery: [timestamp]
□ System(s) affected: [list systems, applications, or repositories]
□ Initial assessment: Does this involve CUI? [Yes/No]
If No: Document rationale and close. If Yes: Continue.
□ Preliminary scope:
- Type of CUI potentially affected: [PII / critical infrastructure / procurement sensitive / other - see CUI Registry]
- Estimated volume: [number of records or files, if known]
- CUI marking observed: [CUI / CUI//SP-PRVCY / other]
□ Incident lead assigned: [name, role]
□ Contracting officer notified internally: [Yes/No, timestamp]
PHASE 2: INVESTIGATION AND CONTAINMENT (Hour 4-48)
□ Root cause analysis initiated:
- Attack vector: [phishing / misconfiguration / insider / supply chain / unknown]
- Indicators of compromise: [list IPs, file hashes, user accounts]
- Timeline of unauthorized access: [start time, duration, end time if contained]
□ Containment actions taken:
- [e.g., isolated affected systems, disabled compromised accounts, applied patches]
- Timestamp of containment: [when threat was stopped]
□ Evidence preserved:
- Logs exported: [Yes/No, storage location]
- Forensic images captured: [Yes/No]
- Chain of custody documented: [Yes/No]
□ CUI impact confirmed:
- Specific CUI accessed or exfiltrated: [describe data types and sensitivity]
- Agency contract(s) affected: [contract number(s)]
- Was CUI encrypted at rest? [Yes/No]
- Was CUI encrypted in transit during incident? [Yes/No - relevant if data was exfiltrated]
PHASE 3: AGENCY NOTIFICATION (Before Hour 72)
Prepare notification to: [agency POC name, email, phone from contract clause]
Required information (adapt to agency-specific format):
1. Contract number: [insert]
2. Contractor point of contact: [name, title, phone, email]
3. Date/time of discovery: [timestamp]
4. Date/time of incident occurrence (if different): [timestamp]
5. Description of incident: [2-3 sentences on what happened]
6. CUI affected: [type, volume, marking]
7. Systems/locations involved: [on-premises / cloud / mobile device / other]
8. Preliminary root cause: [if known]
9. Containment status: [contained / ongoing / eradicated]
10. Potential impact: [data confidentiality / integrity / availability]
11. Remediation actions taken or planned: [list]
12. Law enforcement notification: [Yes/No - if ransomware or criminal activity suspected]
13. [Media sanitization](/glossary/media-sanitization) required: [Yes/No - if devices must be wiped per NIST SP 800-88]
□ Notification sent: [timestamp, method, recipient confirmation]
□ Notification documented in incident file: [Yes/No]
PHASE 4: SUBCONTRACTOR COORDINATION (If applicable)
□ Subcontractor involved: [Yes/No]
□ If Yes:
- Subcontractor name: [insert]
- Subcontractor notification received: [timestamp]
- Subcontractor incident details: [summarize]
- Flow-down clause reference: [contract section]
- Subcontractor remediation plan: [attach or summarize]
PHASE 5: REMEDIATION AND LESSONS LEARNED (Post-notification)
□ Corrective actions implemented:
- [e.g., MFA enforced per 3.5.3, access controls tightened per 3.1.1, encryption applied per 3.13.11]
□ Control gaps identified: [map to NIST SP 800-171 requirements]
□ Timeline for full remediation: [target date]
□ Incident debrief conducted: [date, attendees]
□ Process improvements documented: [what changes to prevent recurrence]
□ Agency follow-up required: [Yes/No - some contracts require final incident reports]
COMPLIANCE NOTES
□ False Claims Act risk assessed: Did we represent compliance with security requirements we weren't meeting? [Document analysis]
□ Audit trail complete: All decisions, timestamps, and communications logged
□ Record retention: Incident file retained per contract requirements [typically 3-7 years]
Customizing the Template
Adapt CUI Types: The CUI Registry lists many categories. If you only handle procurement-sensitive information, you won't need fields for critical infrastructure data. Tailor Phase 1 to the specific CUI categories your agency sends you.
Map to Agency Reporting Format: Some agencies provide incident report forms. Use this template for internal triage, then transfer the information into their required format before the 72-hour deadline. Keep both documents in your incident file.
Integrate Containment Playbooks: Phase 2's containment actions should reference your existing incident response procedures. If you have a ransomware playbook or a lost-device protocol, link to those here rather than duplicating steps.
Define Decision Authority: Specify who decides if something qualifies as CUI and who approves the agency notification. Add role assignments in each phase so your team doesn't waste time debating responsibilities.
Address Subcontractor Flow-Down Explicitly: If you use subcontractors, add a section to your master services agreement requiring them to notify you within 24 hours of discovering a CUI incident. That gives you 48 hours to investigate and report to the agency.
Adjust for DoD vs. Civilian Contracts: If you hold both DFARS 252.204-7012 contracts and civilian agency contracts, you may need parallel workflows. The DoD reporting process routes through the DoD Cyber Crime Center; civilian agencies use their own points of contact. Mark which contract type each incident falls under in Phase 1.
Validation Steps
Test with a Tabletop Exercise: Give your team a scenario: "A developer's laptop with unencrypted CUI was stolen from a vehicle. Walk through the template." Time how long it takes to reach Phase 3. If you can't complete the investigation and reporting prep in 60 hours, identify where the delays occur.
Confirm Logging Captures Required Data: Pull a week of Audit Logging and verify you can answer Phase 2's questions. If you can't determine when unauthorized access occurred or what accounts were involved, you're not meeting NIST SP 800-171 requirement 3.3.2 (review and update logged events). Fix that gap before an incident forces the issue.
Verify Agency POC is Current: Contracting officers change. Email addresses get deactivated. Test your notification path by sending a non-urgent compliance question to the contact listed in your contract. If it bounces, request an updated POC before you need it at 2 a.m. on a Saturday.
Check Subcontractor Contract Language: Pull your flow-down clauses and confirm they explicitly require CUI incident notification to you within a defined timeframe. If the language is vague ("Subcontractor shall comply with all applicable security requirements"), you don't have enforceable leverage. Revise on the next contract renewal.
Document False Claims Act Analysis: The proposed rule's commentary makes clear that misrepresenting compliance with NIST SP 800-171 could trigger False Claims Act liability. Before you submit your first incident report, review whether your organization has claimed compliance with security requirements you're not actually meeting. If you certified NIST SP 800-171 compliance but you're missing controls, document your remediation plan and timeline. That contemporaneous record matters if the government later questions your representations.
The 72-hour window is tight. You'll spend most of it investigating, not writing. This template front-loads the decisions and data collection so you're not improvising under deadline pressure.
