DIB Contractors Face Dual Reporting: CIRCIA or Pentagon?

You're about to report the same cyber incident twice: once to the Pentagon under DFARS 252.204-7012, and again to CISA under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). Unless something changes before the final rule lands, you'll manage two parallel reporting workflows with different timelines, retention periods, and scopes.

CISA sent its final CIRCIA rule to the Office of Management and Budget for review in October 2026. The rule will require critical infrastructure operators, including defense contractors, to report substantial cyber incidents within 72 hours and ransom payments within 24 hours. The problem? You're already doing this for the Pentagon.

The Decision You're Facing

Should you prepare to file dual reports, or hope for regulatory harmonization that may never arrive?

This isn't a philosophical question. It's a resource allocation decision affecting your incident response procedures, documentation workflows, and staff bandwidth. The final rule is expected before year-end, and your decision determines what you build now.

Key Factors That Affect Your Choice

Your contract portfolio determines your exposure. If you handle Controlled Unclassified Information (CUI) under DFARS 252.204-7012, you already report incidents involving CUI to DoD within 72 hours. CIRCIA covers "substantial" cyber incidents regardless of whether CUI was involved.

Formal agreements are the only path to single reporting. CISA's 2024 proposal allows organizations to satisfy CIRCIA by filing a similar report to another federal agency, but only if CISA and that agency have a formal agreement. No agreement means no substitution, even if the reports contain identical information.

The Pentagon's reporting scope is narrower. DFARS 252.204-7012 focuses on incidents involving CUI. CIRCIA's "substantial cyber incident" threshold will likely capture events that never touched CUI but still disrupted your operations or compromised non-Controlled Unclassified Information. Even with a CISA-DoD agreement, you'd still file separate reports for non-CUI incidents.

Retention periods differ. DFARS requires 90 days of incident data retention. CIRCIA proposes two years. Even if you file a single initial report, your documentation and record-keeping obligations multiply.

Follow-up reporting adds complexity. CIRCIA requires supplemental reports as new details emerge. Your existing DoD reporting workflow may not be structured to track and submit updates to two agencies simultaneously.

Path A: Prepare for Dual Reporting Now

Choose this path if:

• You see no evidence of a CISA-DoD formal agreement in progress.
• Your incident response plan needs updating anyway.
• You handle both CUI and non-Controlled Unclassified Information across multiple contracts.
• You have the staff capacity to build parallel documentation workflows before the rule takes effect.

What this looks like in practice:

Map your current DFARS 252.204-7012 reporting process against CIRCIA's proposed requirements. Identify where the scopes diverge. A ransomware attack that encrypts your financial systems but never touches CUI? That's a CIRCIA report. A phishing campaign that exfiltrated CUI from a DoD contract? That's both.

Build intake forms that capture information for both reporting regimes simultaneously. When your security operations center detects an incident, the initial triage should flag whether it meets DFARS thresholds, CIRCIA thresholds, or both. You don't want your team making that determination at hour 71.

Establish separate retention workflows. Your DFARS documentation can sunset at 90 days. Your CIRCIA documentation must persist for two years. Tag records accordingly in your incident management system.

Draft supplemental reporting procedures. CIRCIA's follow-up requirements mean you'll be updating CISA as your investigation progresses. Assign responsibility now for tracking what information you've disclosed to which agency and when updates are due.

The cost: You're building for redundancy before you know whether it's necessary. If CISA and DoD strike an agreement before the rule takes effect, you've invested in infrastructure you may not need.

The benefit: You're compliant on day one, regardless of whether harmonization happens. You've eliminated the risk of scrambling to build dual reporting capabilities after the rule is final.

Path B: Advocate and Wait

Choose this path if:

• Your resources are already stretched by existing compliance work.
• You believe regulatory pressure will force harmonization.
• You're willing to accept late-compliance risk in exchange for avoiding potentially unnecessary work.
• You have executive support to delay preparation until the final rule text is published.

What this looks like in practice:

Monitor the final rule publication closely. When it drops, you'll have a narrow window to assess whether a CISA-DoD agreement exists and what it covers. Use that window to decide whether you're building dual reporting or filing a single report that satisfies both agencies.

In the meantime, engage through industry associations. The Professional Services Council, the National Defense Industrial Association, and sector-specific groups are already pushing for harmonization. Your voice adds weight.

Document your current DFARS reporting process in detail. If you ultimately need to build a parallel CIRCIA workflow, you'll move faster if you have a clear baseline to work from. This isn't full preparation, it's reducing your implementation timeline from months to weeks.

The cost: If no agreement materializes, you're building dual reporting capabilities under deadline pressure. Your first few CIRCIA reports may be rough. You risk non-compliance if you can't stand up the new workflow fast enough.

The benefit: You avoid investing in redundant infrastructure that harmonization might render unnecessary. You preserve resources for other compliance priorities.

Path C: Hybrid Approach

Choose this path if:

• You need to balance compliance risk against resource constraints.
• You can make incremental investments without committing to full dual-reporting infrastructure.
• You want flexibility to pivot based on the final rule text.

What this looks like in practice:

Build the documentation layer now, but delay the operational workflow. Create templates that capture information for both DFARS and CIRCIA reporting. Train your incident response team to recognize which incidents trigger which thresholds. But don't stand up separate submission processes or retention systems until you see the final rule.

This gives you a head start without full commitment. If harmonization happens, you've invested in better documentation practices that benefit your existing DFARS compliance. If it doesn't, you're 60% of the way to dual reporting instead of starting from zero.

Summary Matrix

The Government Accountability Office found that 70% of federal cybersecurity regulations carry the same reporting requirement as at least one other rule, and that harmonization efforts have made limited progress. That track record suggests you should prepare for dual reporting unless you see concrete evidence of a CISA-DoD agreement before the final rule publishes.

Your decision comes down to risk tolerance and resource availability. Make it now, before the final rule forces your hand.