On October 21, 2016, the U.S. Department of Defense (DoD) published the Final Rule<\/a> as Defense Federal Acquisition Regulation Supplement (DFARS) Case 2013-018, entitled \u201cNetwork Penetration Reporting and Contracting for Cloud Services<\/em>.\u201d This rule contains solicitation provisions and contract clauses for contract flow downs, safeguarding and disseminating Covered Defense Information (CDI) and reporting on cyber incidents related to that information. As the requirements, have evolved and changed since the November 2013 version, first draft, please be aware of the subtle differences in your active contracts.<\/p>\n\n\n\n The Oct 21, 2016 Final Rule follows several interim rules published in August 26, 2015 Interim Rule<\/a>, and December 30, 2015 Interim Rule<\/a>. Those were preceded by DFARS Case 2011-D039 titled Safeguarding of Unclassified Controlled Technical Information<\/em>, released on November 18, 2013, which addressed the security requirements for safeguarding unclassified, controlled technical information (UCTI) on contractor systems. DFARS Case 2013-D018 amends the previous regulations and expands requirements specified in DFARS Case 2011-D039 and includes several amended and new clauses and provisions, one of which is DFARS Clause 252.204\u20137012<\/a>.<\/p>\n\n\n\n DFARS Clause 252.204-7012 flows down in all new solicitations and contracts, including those using FAR <\/a>part <\/a>12 procedures<\/a> for acquisition of commercial items. The references below highlight the changes and new requirements.<\/p>\n\n\n\n (1) Covered defense information<\/em> means unclassified controlled technical information<\/a> (UCTI) or other information (as described in the Controlled Unclassified Information (CUI) Registry<\/a>) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is\u2014<\/p>\n\n\n\n (2) Covered contractor information system<\/em> means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.<\/p>\n\n\n\n (1) Contractor owned or operated information systems where CDI resides betmgm live casinoor for covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government.<\/p>\n\n\n\n DFARS 204.73<\/a> Clause<\/p>\n\n\n\n Applicability<\/p>\n\n\n\n (2) Contractor owned\/operated information systems operated on behalf of the customer.<\/p>\n\n\n\n DFARS 239.76<\/a> Clause<\/p>\n\n\n\n Applicability<\/p>\n\n\n\n Contractors shall provide adequate security for all covered contractor information systems, (2) not part of an information technology service or system operated on behalf of the Government<\/p>\n\n\n\n Contractors must report cyber incidents that affect a covered contractor information system or the covered defense information residing therein, or that affects the contractor\u2019s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract. Rapidly report cyber incidents directly to DoD at https:\/\/dibnet.dod.mil<\/a> within 72 hours of discovery and fill in all the required elements on that form. The individuals doing the reporting require a DoD-approved medium assurance certificate to report incidents.<\/p>\n\n\n\n Subcontractors must provide the incident report number from DoD (assigned automatically after submission of the Incident Collection Form) to the prime contractor (or next higher-tier subcontractor) as soon as practicable add Submit to Parsons here<\/a>.<\/p>\n\n\n\n Contractors must conduct a review for evidence of compromise of CDI or ability to provide operationally critical support to DoD, isolate and submit malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer and applicable laws and regulations, preserve and protect images of all known affected information systems and relevant monitoring\/packet capture data for at least 90 days from the submission of the incident report, to allow DoD to request the media or decline interest. If DoD requires review, provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.<\/p>\n\n\n\n Paragraph BetMGM login app(m) of the DFARS 252.204-7012 clause<\/a> must be flowed down, without alteration, except to identify the parties, in any subcontracts or similar contractual instruments in which subcontract performance will involve covered defense information or operationally critical support, including subcontracts for commercial items.<\/p>\n\n\n\n Notify the Prime contractor (or next higher tier subcontractor) when submitting a request to vary from NIST SP-800-171 security requirements, and Parsons as prime contractor will flow down these clauses and provisions to all teammates and subcontractors in support of DoD and handling CDI during the performance of the contract.<\/p>\n\n\n\n Parsons\u2019 subcontractors are required to report cyber incidents directly to DoD at https:\/\/dibnet.dod.mil<\/a> within 72 hours of detection under the mandatory reporting requirement first and then notify their Parsons\u2019 Subcontract Administrator.<\/p>\n\n\n\n Follow Parsons process here<\/a>. Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD.<\/p>\n\n\n\n Department of Defense CIO Site<\/a> (contains June 23, 2017 DoD Industry Day Slides<\/a> and Video)<\/p>\n\n\n\n Department of Defense Procurement and Acquisition Site<\/a><\/p>\n\n\n\n Cybersecurity in DoD Acquisition Regulations<\/a><\/p>\n\n\n\n NIST 800-171<\/a><\/p>\n\n\n\n DRAFT NIST 800-171A<\/a><\/p>\n\n\n\n DoD in conjunction with NIST Manufacturing Extension Partnership (MEP) has published a self-assessment guide on meeting DFARS requirements. The Handbook is intended to be a guide to assist U.S. manufacturers who supply products within supply chains for the DOD and who must ensure adequate security by implementing NIST SP 800-171 as part of the process for ensuring compliance with DFARS clause 252.204-7012, \u201cSafeguarding Covered Defense Information and Cyber Incident Reporting.\u201d NIST MEP Cybersecurity Self-Assessment Handbook For Assessing NIST SP 800-171 Security Requirements in Response to DFARS Cybersecurity Requirements<\/a><\/p>\n\n\n\n DFARS Case 2013-D018: Network Penetration Reporting and Contracting for Cloud Services<\/p>\n\n\n\nRequirements<\/h3>\n\n\n\n
Definitions<\/h3>\n\n\n\n
\n
Two Use Cases<\/h3>\n\n\n\n
\n
\n
\n
\n
Adequate Security<\/h3>\n\n\n\n
(1) operated on behalf of the customer<\/p>\n\n\n\n\n
\n
\n
Cyber incident reporting<\/h3>\n\n\n\n
Subcontractor flow down<\/h3>\n\n\n\n
provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD.<\/p>\n\n\n\nParsons Implementation of DFARS For Subcontractors<\/h3>\n\n\n\n
References<\/h3>\n\n\n\n