Free Cyber Risk Analysis: Your Top Cyber Risks in 3 Clicks

Get Started
Request Demo

If your company generates Department of Defense(DoD) related revenue, you likely fall under DFARS. If you want your DoD contracts to continue after the end of 2017, you need to look closely at the Defense Federal Acquisition Regulation Supplement (DFARS) clause 225.204-7012. The regulation gives all government contractors a deadline of December 31, 2017, to implement NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

What is the DFARS mandate?

The federal government relies on external services to help carry out various federal missions and business functions. Many federal contractors and subcontractors “routinely process, store, and transmit sensitive federal information in their information systems to support the delivery of essential products and services to federal agencies.” With that being said, the contractor community has to provide assurance to DoD that their IT system can offer a high level of security to protect this sensitive information.

The document details requirements for protecting Controlled Unclassified Information (CUI) when:

  • The CUI is resident in nonfederal information systems and organizations

  • The information systems where the CUI resides are not used or operated by contractors of federal agencies or other organizations on behalf of those agencies.

  • Where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category or subcategory listed in the CUI Registry

In practical terms, although companies that work with the DoD already apply rigorous controls over classified data, the protection is now extended to the unclassified systems that include covered defense information, which creates wider-reaching consequences for the contractors.

Who is impacted by NIST 800-171?

The requirements apply to all components of nonfederal information systems and organizations that process, store, or transmit CUI or provide security protection for such components, which can be found in the CUI category list. The CUI requirements are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations/

What should you do?

While implementing those requirements might seem arduous, it is important to know that these NIST standards are best practices that your company could have already implemented to maintain a good security system. Each requirement on the list can help your firm stay away from different cyber events and safeguard CUI.

Even though a company needs to consider many aspects, such as budget and resources, keep in mind that achieving compliance is your only option, and the clock is ticking. Use our DFARS compliance guide to align with this crucial framework.
 

Review your DFARS Compliance Checklist

DFARS Compliance Step Checklist
Run a Security Assessment This can help you have a clear vision of where your organization stands and if you are in compliance with all the requirements.
Implementation
  • Once you have identified all the deficiencies in your IT system, you need to create a plan to help you complete the implementation. It should protect all the sensitive defense information and strengthen your system. Your POAM & SSP are crucial to documenting this step.
Partner with a Third Party Find a trustworthy and experienced company to run your assessment, ease the process, and monitor and document continuing compliance. NIST SP 800-171 compliance is dynamic; only weeks are left until the deadline. Reaching compliance, for now, is just the start, but maintaining compliance is key.

 

The government has made this change in regulation to improve the security of the U.S. Future contracts include DFARS in their terms, so if you want to win contracts in the future, it is highly recommended that you comply before the deadline.

Discover how you can get your cyber risk assessment, compliance documents, and policies DFARS compliant to retain existing contracts with a CyberStrong demo.

CyberStrong streamlines your audit process with the click of a button and is the all-in-one cyber risk management platform with which you can prove continuous control compliance and benefit from increased risk visibility, communication, and measurement.

You may also like

How to Create a Cyber Risk ...
on June 10, 2024

In today's fast-paced digital landscape, conducting a cyber risk assessment is crucial for organizations to safeguard their assets and maintain a robust security posture. A cyber ...

Critical Capabilities of ...
on June 4, 2024

Continuous Control Monitoring (CCM) is a critical component in today's cybersecurity landscape, providing organizations with the means to enhance their security posture and ...

A NIST AI RMF Summary
on May 29, 2024

Artificial intelligence (AI) is revolutionizing numerous sectors, but its integration into cybersecurity is particularly transformative. AI enhances threat detection, automates ...

Critical Capabilities of Cyber ...
on May 20, 2024

In today's digital landscape, robust cybersecurity risk assessment tools are crucial for effectively identifying and mitigating cyber threats. These tools serve as the first line ...

A Practical Approach to FAIR Cyber ...
on May 10, 2024

In the ever-evolving world of cybersecurity, managing risk is no longer about simply setting up firewalls and antivirus software. As cyber threats become more sophisticated, ...

Unveiling the Best Cyber Security ...
on April 24, 2024

Considering the rollout of regulations like the SEC Cybersecurity Rule and updates to the NIST Cybersecurity Framework; governance and Board communication are rightfully ...