The Cybersecurity and Infrastructure Security Agency has issued a binding operational directive requiring all federal contractors to report cybersecurity incidents within 72 hours of detection. The mandate applies to any company holding active federal contracts valued at $500,000 or more.
Contractors must report the nature of the incident, affected systems, estimated impact, and initial remediation steps through CISA's updated reporting portal. Failure to comply can result in contract suspension, financial penalties, and exclusion from future federal procurement opportunities.
The directive also requires contractors to maintain and share a current software bill of materials for all products delivered to federal agencies, enabling faster vulnerability assessment when new threats emerge.
