CUI comes through the contract, and so does DFARS 252.204-7012. Most of the attention goes to its NIST SP 800-171 requirement. The incident reporting rules in the same clause matter just as much on a bad day, and some steps can't wait until then.

What the clause requires

When you discover a cyber incident that affects a covered contractor information system or the covered defense information on it, DFARS 252.204-7012(c)–(e) requires you to:

Review for evidence of compromise of covered defense information, including compromised computers, servers, specific data and user accounts- Rapidly report the incident to DoD at https://dibnet.dod.mil .…