Your Top Five Cyber Risks in Five Clicks with the Free Cyber Risk Analysis

FREE RISK ANALYSIS
Request Demo

A while back, Lockheed Martin published New Guidelines for Adhering to Department of Defense (DoD) Requirements. This overview is for their supply chain and vendors specifically and gives good insight into the process that large defense contractors are embarking on to become compliant and save their DoD contracts. This process is important not only for those larger contractors but also for the supply chain members. Those who have DoD-related revenue, regardless of size, or want to generate similar revenue in the future must comply with DFARS by the end of the year to win contracts. Ultimately, it's a regulation and gives an organization the upper hand over the competition, as those who win contracts will have to become compliant if they aren't already.

Lockheed gave some interesting and informative answers to popular questions, especially regarding questionnaires sent down the supply chain by prime contractors. The question of whether filling out this questionnaire is enough to comply or whether it is just a means for initiating the compliance process by these larger contractors was addressed. Therefore, the third answer in the list is the most informative from what we've seen. Here's the FAQ:

Frequently Asked Questions

As a supplier, do I need to notify Lockheed Martin of my compliance status on cyber DFARS clause 252.204-7012?

If a supplier is non-compliant with the NIST cybersecurity controls outlined in the cyber DFARS clause 252.204-7012 dated December 2015, then the supplier must notify the DoD CIOs office within 30 days of contract award with LMC of the areas of non-compliance. The supplier must copy Lockheed Martin through the authorized procurement representative identified in the subcontract or purchase order on the DoD notification.

What are the incident reporting requirements for suppliers?

A supplier must report an incident within 72 hours of discovery to both 1) Lockheed Martin (e.g. Lockheed Martin Subcontract Program Manager (SPM), Buyer, or Subcontract Administrator (SCA)) and in parallel to 2) the DoD at the following DFAR directed site: DOD Dibnet. LM SPMs, buyers, and/or SCAs must immediately notify the LM CIRT of supplier cyber incident reports. Please note: the cyber incident reporting requirements associated with this cyber DFARS clause do not negate any additional reporting requirements found in the contract between Lockheed Martin and the supplier.

How is the cybersecurity questionnaire used by Lockheed Martin different than the actions required by cyber DFARS clause 252.204-7012?

The cybersecurity questionnaire in Exostar is used as a tool to obtain a high-level understanding of a supplier’s ability to protect sensitive information and manage cybersecurity risk. To be clear, performing all activities outlined in the questionnaire does not satisfy the requirements associated with cyber DFARS clause 252.204-7012. Suppliers which store/process CDI are responsible for assessing their systems for compliance with the requirements outlined in cyber DFARS clause 252.204-7012."

Download your free guide to DFARS compliance. 


So, it's clear that a questionnaire alone won't get you compliant, but paying for hours of consulting and outsourcing to a third party may be too costly or inefficient enough for those who want an easy in-house solution. Doing DFARS in-house also ensures you'll be up to date, as you'll have to report or prove compliance with your new contracts continuously, and having that information readily available with artifacts that show your status is a huge advantage. 

CyberStrong can streamline your DFARS assessment and provide an automated way of creating compliance documents (POAM and SSP). You could save hours of time wondering the best path to compliance and assessing different options. CyberStrong gives you the optimal path tailored to your organization by allowing you to see clearly into your cybersecurity program and identify gaps and low-cost remediation strategies. There's still time, and we take clients before the deadline. It's not too late to get compliant and have the advantage of complying ahead of your competition. 

You may also like

Putting the “R” back in GRC - ...
on November 20, 2024

Cyber GRC (Governance, Risk, and Compliance) tools are software solutions that help organizations manage and streamline their cybersecurity, risk management, and compliance ...

October Product Update
on October 17, 2024

The team at CyberSaint is thrilled to announce the latest additions and updates to the CyberStrong solution. To start off, we’ve made it easier to create an assessment and risk ...

Transforming Cyber Risk ...
on October 12, 2024

In today’s complex cyber landscape, managing risks effectively isn’t just about identifying threats—it’s about understanding their impact and knowing how to prioritize ...

Step-by-Step Guide: How to Create ...
on November 20, 2024

Cyber risk management has become more critical in today's challenging digital landscape. Organizations face increased pressure to identify, assess, and mitigate risks that could ...

From Fragmentation to Integration: ...
on November 20, 2024

Organizations are often inundated with many security threats and vulnerabilities in today's fast-paced cybersecurity landscape. As a result, many have turned to point ...

How to Create a Comprehensive ...
on November 20, 2024

Cyber threats are becoming more frequent, sophisticated, and damaging in today's rapidly evolving digital landscape. Traditional approaches to cyber risk management, which often ...