Cybersecurity Incident

A cybersecurity incident is an event that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information it processes, stores, or transmits, or that constitutes a violation of security policies. Not every security event is an incident — incidents are events that require a response.

For defense contractors, incidents involving CUI have specific reporting obligations under DFARS 252.204-7012, including notification to the DoD within 72 hours. The definition of what constitutes a reportable incident is important — it includes not just confirmed breaches but also events where CUI may have been compromised.