DHS CUI requirements for contractors, what HSAR asks

What does HSAR 3052.204-72 require of a DHS contractor?

A contractor or subcontractor with a DHS contract must report known or suspected incidents involving PII or sensitive PII within 1 hour of discovery, and all other incidents within 8 hours, to the DHS Component Security Operations Center or the DHS Enterprise SOC. CUI sent by email must be encrypted or sent through a secure system using a FIPS 140-2 or 140-3 validated cryptographic module, and regular email is allowed only for Federal information systems when that is impractical. After an incident, the contractor must preserve images of affected systems and keep monitoring and packet capture data for at least 180 days from the incident report. At contract end, DHS CUI must be returned or destroyed as the contract states, following NIST SP 800-88, and the sanitization must be certified to the COR and contracting officer using the SP 800-88 Appendix G template.

The effort and timing behind these obligations depend on three things: the systems in scope under the contract, the DHS policies and procedures in effect at award (which the clause makes part of adequate security), and whether the contractor operates systems on DHS's behalf. Under 32 CFR 2002.14(h)(1), a system a contractor operates for an agency is treated as a Federal information system, which opens it to additional agency requirements. Ask the contracting officer which DHS policy version applies, which systems the clause covers, and whether any system is operated for DHS rather than merely handling incidental federal data. The clause names no price, no certification and no assessment fee, so those figures must come from the contract and your own quotes, not from the clause.

Your organization owns its controls and the obligations. An implementation partner can prepare systems, encryption, logging and evidence records, but only an independent auditor or assessor issues any report or attestation. Confirm with the COR and contracting officer, in writing, the incident contacts, the reporting clock start, the evidence retention scope and the sanitization certificate format before work begins, so the scope and the quote match what DHS will actually review.

Which obligations in the clause change your daily operations?

HSAR 3052.204-72 turns into six working duties once a DHS contract is awarded: report incidents on a clock, encrypt CUI email, preserve evidence, accept inspections, sanitize at contract end, and certify the sanitization. Each one needs a named owner, a tested procedure and a record that an assessor or DHS can inspect. Subcontractors inherit the reporting duty, so the chain of notification has to reach them too.

Incident reporting clock

Known or suspected incidents involving PII or sensitive PII must be reported within 1 hour of discovery, and all other incidents within 8 hours. Reports go to the DHS Component Security Operations Center or the DHS Enterprise SOC, and the clause flows down to subcontractors. Check that the on-call roster, the reporting contacts and the discovery timestamp rule are written down and rehearsed, and that subcontract terms carry the same clock.

FIPS-validated CUI email

CUI sent by email must be encrypted, or sent through a secure system, using a cryptographic module validated under FIPS 140-2 or FIPS 140-3. Regular unencrypted email is allowed only on Federal information systems when this is impractical. Confirm that your mail gateway, client encryption and any file-share alternatives use validated modules, and check the module certificate status rather than the vendor's marketing claim.

Evidence preservation for 180 days

After an incident, keep images of affected systems and retain monitoring and packet capture data for at least 180 days from the incident report. This means logging storage, snapshot procedures and legal hold steps must be in place before an incident occurs, because captures that roll over early cannot be recovered. Test that you can export and hash an image and that retention settings match the 180-day minimum.

Inspections and forensic reviews

The clause lets DHS respond to an incident with inspections, forensic reviews and revocation of the authority to operate. Your practical job is to keep system documentation, network diagrams, access records and logs in a form that can be produced quickly, and to know who in your organization would host a DHS inspector. Ask the contracting officer which inspection terms apply to your specific system before an incident forces the question.

Return or destroy DHS CUI

At contract end, DHS CUI must be returned or destroyed as the contract states, using the sanitization methods of NIST SP 800-88. The contract, not your default retention schedule, decides which option applies. Build an inventory of where DHS CUI sits, including backups, endpoints and cloud storage, so the disposition plan covers every copy, and confirm the disposition instructions with the COR in writing.

Sanitization certificate to DHS

After sanitization, certify it to the COR and contracting officer using the template in NIST SP 800-88 Appendix G. The certificate is a record that someone accountable has verified the method, the media and the date. Assign the signer in advance, keep the sanitization log that supports the certificate, and make sure the certificate reaches both named officials, since a certificate sent to only one of them may not satisfy the clause.

Why adequate security is defined by DHS policy, not NIST SP 800-171

Under HSAR 3052.204-72, the measure of adequate security for DHS CUI is not NIST SP 800-171. The clause defines adequate security to include compliance with DHS policies and procedures in effect at contract award, which DHS publishes on its security and training requirements page for contractors. That means your control baseline for DHS work is a moving target fixed at a single date, and the first task is to pull the DHS policies in effect on the award date, record that date in your contract file, and keep a copy of each document as it stood at award. Do not assume the current version on the website is the one that governs your contract.

Next, build a crosswalk from those DHS policy requirements to your existing control set, whether that set is built on NIST SP 800-171, NIST SP 800-53 or another framework. Where a DHS requirement has no counterpart, you have a gap to close or a documented decision to make. Where SP 800-171 is also cited elsewhere in the contract, the contract's own references may add requirements on top of the DHS policies, so ask the contracting officer to confirm in writing whether SP 800-171 or any other standard applies beyond HSAR 3052.204-72. Treat the answer as part of the contract baseline, not as an internal opinion.

The federal rules also determine how far DHS requirements reach into your environment. Under 32 CFR 2002.14(h)(1), a system you operate on behalf of an agency is treated as a Federal information system, as though it were the agency's own, and it is open to additional agency requirements. Under 32 CFR 2002.14(h)(2), a system that receives federal information only incidentally while you provide another product or service is not a Federal system. Before you scope a DHS enclave, document which systems fall on each side of that line, because the answer determines whether DHS can impose requirements beyond its published policies.

How to apply the clause from contract award to sanitization certificate

This sequence takes the HSAR 3052.204-72 obligations from contract award through incident readiness, encryption, evidence preservation and end-of-contract sanitization, so each obligation has a named owner and a record that shows it was met.

Build the clause and policy register at award
Start by reading the contract for every DHS clause it incorporates, then pull the DHS security and training requirements for contractors as they stand on the award date. The clause defines adequate security by reference to DHS policies in effect at award, so the version you collect at this point is the one you will be held to. Record each policy, its version and its publication date in a single register owned by the contract manager and the security lead. The step is done when the register lists every obligation with a named owner and the contracting officer has confirmed in writing that the list is complete.
Classify the DHS CUI and PII in scope
Work with the contracting officer's representative to identify which data the contract covers, separating DHS CUI from personally identifiable information and sensitive PII. The reporting windows in the clause depend on this split, because PII and sensitive PII incidents carry the shorter 1-hour window, so mislabeled data creates reporting risk. Ask the agency to confirm categories in writing where the contract is unclear. The output is a data classification record that maps each data type to its handling rule and its reporting category.
Define systems in scope and test for Federal status
List every system, cloud tenant, endpoint and subcontractor service that will store, process or transmit DHS CUI. For each one, determine whether it is a Federal information system under 32 CFR 2002.14(h)(1), which applies when you operate the system on behalf of the agency, or whether it only receives federal information incidentally under 2002.14(h)(2). A Federal system carries additional agency requirements, so this determination shapes your architecture and your obligations. Have counsel or the contracting officer confirm the conclusion. The output is a scope statement with a system inventory and a written Federal-status finding for each system.
Stand up incident contacts and a reporting runbook
Establish the reporting path to the DHS Component Security Operations Center or the DHS Enterprise SOC that applies to your contract, and assign named staff who can start a report within the 1-hour window for suspected PII incidents and the 8-hour window for other incidents. Confirm the routing and the contact method with the agency before an incident occurs, and test that after-hours coverage actually answers. Write a runbook that starts from detection, names the decision maker who classifies an event as PII or non-PII, and records the time of discovery. The output is a tested runbook and an on-call roster that you can show to the contracting officer.
Deploy and record FIPS-validated email encryption
Configure email so that any DHS CUI sent by message is either encrypted or sent through a secure communications system that uses a FIPS 140-2 or 140-3 validated cryptographic module. Regular email is allowed only for Federal information systems when this is impractical, so the default route should be the validated one. Confirm the module's validation certificate and its status with the vendor, because validation status is a fact to verify, not assume. Document the mail gateway settings, the encryption rules and the users who may send CUI. The output is an encryption configuration record with the validation references and a test showing that a CUI message leaves the system encrypted.
Write the evidence preservation procedure
After an incident, the clause requires you to preserve images of affected systems and keep monitoring and packet capture data for at least 180 days from the incident report. Write a procedure that tells responders how to capture disk images, which logs and packet captures to retain, where they are stored, who can access them and how chain of custody is recorded. Confirm the retention platform can hold packet capture for the full period without overwriting, and check that it is covered by your access controls and backups. The output is a preservation procedure and a test restore that shows an image and capture can be retrieved on demand.
Document the destruction method under NIST SP 800-88
At contract end, the clause requires you to return or destroy DHS CUI as the contract states, following NIST SP 800-88. Decide the method for each media type, such as cryptographic erase, purge or physical destruction, and select the method according to the sensitivity and the media. Record which systems and backups are covered, and confirm with the contracting officer whether return or destruction applies to each dataset. The output is a sanitization plan that lists each media class, the chosen SP 800-88 method and the person who will perform and verify it.
Produce the signed sanitization certificate at close
Once destruction or return is complete, complete the sanitization certificate using the template in SP 800-88 Appendix G and send it to the contracting officer's representative and the contracting officer, as the clause requires. Attach the sanitization log, the verification results and the chain of custody for any returned media. Have an authorized officer of your organization sign the certificate, and keep a copy with the contract file. The step is done when the agency acknowledges receipt in writing. Ask the agency whether it expects any additional attestation, because the contract may add requirements beyond the template.

Which parts of the clause apply to your situation?

When your organization operates a system on behalf of DHS, 32 CFR 2002.14(h)(1) treats that system as a Federal information system, treated as though it were the agency's own and open to additional agency requirements. In practice, the clause's incident reporting, preservation and inspection duties are the ones most likely to apply in full, and DHS may impose requirements beyond the clause text through the contract.

Incident reporting clock: Expect the 1-hour and 8-hour reporting windows to apply to the system you run, measured from discovery.
Preservation and access: Expect to preserve images and monitoring data for at least 180 days and to accommodate inspections, forensic reviews and possible revocation of the authority to operate.
Agency-defined controls: Expect DHS policies in effect at award to set adequate security, which may go further than your own baseline.
Evidence changes: Keep logs, system documentation and access records in a form DHS can inspect, not only in your internal tools.
Sanitization at end of contract: Plan NIST SP 800-88 sanitization and the certificate for any DHS CUI on the system.

Confirm with the contracting officer which DHS policies apply and whether DHS will inspect your environment directly.

What must be in place before a DHS contract audit or review

A DHS inspection, forensic review or contract review tests whether the contractor can produce evidence quickly, not whether a policy exists on paper. The six items below are the artifacts and configurations that clause-driven reviews tend to request first, and each one names who produces the evidence.

Dated DHS policy register

HSAR 3052.204-72 measures adequate security against DHS policies and procedures in effect at contract award, published on DHS's security and training requirements page for contractors. Build a register that lists each applicable DHS policy, its version, the date you pulled it, and the award date it was tied to. Check that the register matches the contract's award date, not the date of the last update. Compliance leads produce the register, and the contracting officer's representative should confirm the version set.

Incident reporting runbook with SOC contacts

The clause sets two clocks: one hour from discovery for known or suspected incidents involving PII or sensitive PII, and eight hours for all other incidents. The runbook should name the DHS Component Security Operations Center or the DHS Enterprise SOC contact for each path, the person who starts each clock, and the decision steps that separate the two categories. Test it with a tabletop exercise and keep the timed record. The incident response lead owns the runbook and the security operations team produces the exercise evidence.

Tested email encryption path

CUI sent by email must be encrypted or sent within a secure system using a FIPS 140-2 or 140-3 validated cryptographic module. Regular email is allowed only for federal information systems when that is impractical. Send a test message of each type you use, confirm that the module is active and FIPS-mode enforced, and save the transmission logs. Keep the module's validation certificate number on file, and confirm that the certificate is current in NIST's validated module list. The IT operations team produces the test records, and the security officer signs off on the validation records.

Log and packet capture retention at 180 days

After an incident, the contractor must preserve images of affected systems and keep monitoring and packet capture data for at least 180 days from the incident report. Confirm that log platforms, packet capture tools and backup targets are configured with retention and legal hold that meet or exceed this period, and that deletion jobs cannot run on the held data. Run a restore or export test to prove the data is readable. The platform engineering team produces the configuration exports, and the incident response lead confirms the hold procedure.

Sanitization procedure with SP 800-88 certificate

At contract end, the contractor returns or destroys DHS CUI as the contract states, following NIST SP 800-88, and certifies sanitization to the COR and contracting officer using the template in SP 800-88 Appendix G. Write a procedure that names the media types in scope, the sanitization method for each, and the person who signs the certificate. Test it on a sample device and file the completed template. The IT asset manager produces the sanitization records, and the contract manager confirms the disposition matches the contract.

CUI inventory tied to the system security plan

A reviewer will want to see where DHS CUI lives before deciding what the security controls cover. Build an inventory of systems, repositories, email accounts, backups and endpoints that hold or process DHS CUI, and map each entry to the system security plan boundary and the controls that protect it. Flag any system that a contractor operates on behalf of DHS, since 32 CFR 2002.14(h)(1) treats it as a federal information system open to additional agency requirements. The compliance lead owns the inventory, and system owners confirm each entry.

Who owns each DHS obligation, and who can help

The contractor owns every obligation in the clause. Reporting decisions, sanitization certifications and the reading of what "adequate security" means under DHS policy stay with the contractor's officers, security staff and counsel. Under HSAR 3052.204-72, the duties are the contractor's, including those carried out by its subcontractors.

Control ownership: Named owners for each DHS policy in effect at contract award and for each control the contract depends on.
Reporting decisions: Deciding whether an event involves PII or sensitive PII, starting the 1-hour or 8-hour clock, and filing with the correct DHS Component SOC or the DHS Enterprise SOC.
Sanitization decisions: Choosing return or destruction as the contract states, following NIST SP 800-88, and signing the sanitization certification sent to the COR and contracting officer.
Contract interpretation: Reading the clause alongside the contract, subcontract flow-downs and any DHS policy updates, and escalating unclear terms to the contracting officer.

Outsourcing usually covers forensic analysis, log tooling and runbook drafting. The decisions and signatures stay in-house, because a partner that makes a reporting call or signs a certificate has taken on a role it cannot legally hold for the contractor. Before a contract begins, confirm that a named officer can sign certifications and that someone is on call for the reporting clock at all hours.

What usually delays DHS CUI compliance or creates findings

Most findings under the DHS clause do not come from missing technology. They come from treating NIST SP 800-171 as the whole standard, from undefined internal triggers, and from evidence that cannot be produced when a contracting officer asks for it. The six pitfalls below are the places where contractors most often fall short, and each one has a concrete check that prevents it.

Stopping at NIST SP 800-171

HSAR 3052.204-72 defines adequate security for DHS CUI by reference to DHS policies and procedures in effect at contract award, published on DHS's security and training requirements page for contractors. Teams that build only to NIST SP 800-171 can miss DHS-specific requirements. Pull the DHS policy set in effect on the award date into the contract file, map each item to an owner, and record which version you assessed against.

Undefined incident discovery

The 1-hour clock for known or suspected incidents involving PII or sensitive PII, and the 8-hour clock for other incidents, start at discovery. If nobody has written down who counts as discovering an event, the clock is effectively started by whoever notices last. Define discovery in the incident response plan, name the on-call roles that must escalate, and test the path to the DHS Component Security Operations Center or DHS Enterprise SOC with a tabletop exercise.

CUI sent through regular email

CUI sent by email must be encrypted with a FIPS 140-2 or 140-3 validated cryptographic module, or sent within secure communications systems. Regular email is permitted only for Federal information systems when the secure path is impractical. Inventory where CUI leaves through mail clients, scanners and mobile devices, configure enforced encryption, and keep the module validation certificate numbers with the system security documentation.

Log retention shorter than preservation

After an incident, the contractor must preserve images of affected systems and keep monitoring and packet capture data for at least 180 days from the incident report. Many default log and capture settings roll over far sooner, so the evidence is gone when DHS asks for it. Check retention on SIEM indexes, endpoint telemetry and any packet capture tool, then set a legal-hold procedure that stops deletion when an incident report is filed.

Sanitization certificates without a method

At contract end, DHS CUI must be returned or destroyed as the contract states, following NIST SP 800-88, and the sanitization must be certified to the COR and contracting officer using the SP 800-88 Appendix G template. A signed certificate with no recorded method, tool or media list is hard to defend. For each media class, document the SP 800-88 sanitization level chosen, the tool or process used, who performed it, and the verification step, then attach that record to the certificate.

Subcontractors without flow-down

The clause applies to contractors and subcontractors, so the reporting duty and the CUI handling terms must reach every subcontractor that touches DHS CUI. Subcontracts that omit the clause leave the prime exposed when a sub is slow to report. Insert the clause into each subcontract that handles DHS CUI, require the sub to confirm its own discovery and reporting path, and keep signed flow-down records in the contract file for review.

Questions contractors ask about the DHS CUI clause

Does HSAR 3052.204-72 require compliance with NIST SP 800-171?

Not directly. The clause defines adequate security for DHS CUI as including compliance with DHS policies and procedures in effect at contract award, which are published on DHS's security and training requirements page for contractors, rather than pointing contractors to NIST SP 800-171. Read the clause and the DHS policies named in your contract together, and ask the contracting officer which version applies and whether any NIST SP 800-171 expectations come in through other clauses or the agency's own requirements.

What counts as a reportable incident, and when does the clock start?

Known or suspected incidents involving PII or sensitive PII must be reported within 1 hour of discovery, and all other incidents within 8 hours. Reports go to the DHS Component Security Operations Center or the DHS Enterprise SOC, as the clause directs. Because the clock runs from discovery, the practical work is an internal triage process that lets engineers classify an event quickly, plus a named owner who can make the call at any hour. Confirm the exact reporting channels and contacts with your contracting officer before award.

Can a contractor ever send DHS CUI by regular email?

Only in a narrow case. The clause requires CUI sent by email to be encrypted or sent within secure communications systems using a FIPS 140-2 or 140-3 validated cryptographic module. Regular email is allowed only for Federal information systems when using a validated method is impractical. Check which mail platforms, gateways and mobile clients your team uses, and confirm that each one can use validated encryption. Ask the vendor for the validation certificate number and check it against the current NIST validation list, since validation status changes over time.

What does the 180-day evidence preservation duty require in practice?

After an incident, the contractor must preserve images of affected systems and keep monitoring and packet capture data for at least 180 days from the incident report. The duty only works if logging and capture are already running before an incident, because data that was never collected cannot be preserved. Plan retention storage, access controls on the preserved material, and a chain of custody procedure. The clause also allows DHS to carry out inspections, forensic reviews and revocation of the authority to operate as part of incident response, so keep system documentation current.

How is sanitization of DHS CUI certified at contract end?

The contract states whether DHS CUI is returned or destroyed. Either way, the contractor sanitizes media following NIST SP 800-88 and certifies the result to the COR and contracting officer using the template in SP 800-88 Appendix G. Build the process before the contract ends: inventory where CUI was stored, including backups and cloud services, assign owners for each sanitization method, and keep records that tie each certificate to specific media. Confirm with the contracting officer whether a particular format of certificate is required.

Does the clause include a certification or an SPRS-style score?

The clause itself does not create a certification, an assessment score or a submission requirement like the DoD's SPRS entry. Its obligations are reporting, encryption, preservation, sanitization and adherence to DHS policy. Your contract may still require an assessment, an authorization or evidence reviews under other terms, so read the full award and ask the contracting officer what documentation the agency will accept. Only an independent auditor or certification body can issue an audit report or certificate, and DeployOpen does not issue them.

How much effort does DHS CUI compliance take, and what drives it?

The clause does not publish an effort estimate, so the effort depends on your environment and on the DHS policies in force at award. The main drivers are how many systems hold DHS CUI, how mature your logging, encryption and incident response already are, how many subcontractors touch the data, and how many email or collaboration paths exist. Ask the contracting officer for the DHS policy version that applies, and ask any partner for a written scope that lists each system, the deliverables and the timeline before work starts.

Can a contractor meet these requirements without outside help?

Yes, if the team already has the skills to build and run the controls, and the contract is small enough to manage internally. Many contractors handle the work in-house, while others bring in outside help for specific parts, such as configuring self-hosted logging and retention, validated encryption for email, or incident response exercises. An implementation partner prepares systems and evidence, but the organization owns its controls and an independent assessor issues any report. Ask any firm for a fixed scope in writing before you agree to work.

How DeployOpen prepares DHS CUI systems and evidence

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure so that the systems and records behind HSAR 3052.204-72 can be shown to DHS. We prepare the controls and evidence; your organization owns its controls, and only an independent assessor or the contracting agency reviews and accepts them.

How we scope

We start with a written scope that names the DHS contract, the systems that hold or transmit DHS CUI, and the boundaries between them.
We confirm which DHS policies and procedures in effect at contract award apply, and ask the contracting officer or COR to confirm them.
We map the clause's incident reporting, email encryption, preservation and sanitization duties to named systems and owners before any build work begins.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts.

How we build

We deploy self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks, with logging set up to capture what incident response needs.
We configure email protection for DHS CUI using cryptographic modules that you confirm carry FIPS 140-2 or 140-3 validation.
We set up image capture, monitoring and packet capture retention so that records can be held for the 180-day period the clause describes.
We test the configuration against the clause's requirements and document the results for your review.

How we hand over

You receive system documentation, configuration records, runbooks for 1-hour and 8-hour reporting, and sanitization procedures aligned to NIST SP 800-88.
We provide an evidence index that maps each clause duty to the logs, configurations and records that show it operates.
Sanitization certificate templates are prepared for your use, and you or your authorized signatory issue them to the COR and contracting officer.
We walk your team through the handover so operators can run and show the controls without us.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
We can prepare evidence refreshes when DHS policies change or when the contracting officer requests additional records.
Support scope, response expectations and fees are set in a written agreement, and we do not publish a price list; a quote follows from the scope.