Insights · Field note · Infrastructure and resilience
Continuity obligations in government contracts
A government contract can make continuity a legal obligation with reporting deadlines, not a best practice. Read the clauses before the outage.
Government contracts carry continuity obligations that many contractors discover during a disruption: service levels the agency expects to be met during incidents; cyber incident reporting within fixed deadlines, such as the 72-hour reporting required by DFARS 252.204-7012 for covered defense information; preservation of affected systems and data for investigation; flow-down of the same obligations to subcontractors; and, under frameworks such as NIST SP 800-171 and CMMC, the requirement to protect and recover the information the contract covers. Reading the clauses before an outage, mapping each to a plan and a named owner, and exercising the reporting timeline are what separate a disruption from a contractual breach.
In detail
What the evidence shows.
Reporting on a clock
DFARS 252.204-7012 requires rapid reporting of cyber incidents affecting covered defense information and preservation of images and data for a defined period. Other agencies and contracts impose their own timelines. The clock runs from discovery, during the hours when the organization is least organized, which is why the procedure is written and rehearsed in advance.
Service and recovery expectations
Contracts state service levels, availability and sometimes recovery objectives. The continuity and recovery plans must meet them, and the test records must show that they can. A contractor whose plan recovers in three days under a contract that expects one has an obligation it cannot meet.
Flow-down
Prime contractors pass obligations to subcontractors. A subcontractor’s outage or incident becomes the prime’s reporting event. Supplier continuity commitments, assessed and recorded, are part of the prime’s own plan.
Mapping clauses to plans
Each obligation gets a plan section, an owner, a procedure and an exercise. The mapping is the evidence a contracting officer or assessor asks for. See government contractors, business continuity planning and breach escalation procedures.
Sources
Primary references.
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (Acquisition.gov)
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (maintenance and physical protection requirements)
- ISO 22301:2019, Security and resilience, business continuity management systems, requirements (ISO)
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days