<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

The Defense Federal Acquisition Regulation Supplement (DFARS) mandate, specifically Clause 252.204-7012 requiring all members of the Department of Defense (DoD)’s supply chain to comply with NIST SP 800-171 is nothing new. For a year now, the DFARS mandate has been required of all members of the DoD supply chain. Until this point, while signing off on DoD compliance has been necessary to winning DoD-related business, there has been no substantial moves by the DoD to ensure that their suppliers are truly compliant. Until now.

On January 21, 2019, Under Secretary for Defense Ellen M. Lord issued a memo to defense acquisition leaders her intent to audit the DoD supply chain for DFARS compliance. The memo states that she has called upon the Defense Contract Management Agency (DCMA) to audit all prime government contractors for compliance and assess their processes for compliance with the primes’ tier one suppliers. This organization will be delivering quality audits to organizations in the defense industrial base, and in anticipation board of directors as well as internal audit management programs within aerospace, defense, and manufacturing companies among others are beginning to prepare. These information technology audits require enhanced data security, internal control, and data integrity on the part of the DoD supply chain. Enterprise audit management software is a tool that DoD suppliers could use to both track compliance and report to internal auditors and external auditors alike when they come knocking.

What This Means For Suppliers

As we wrote in November with the release of the National Cyber Strategy, this administration is clearly committed to improving and enforcing the cybersecurity regulations related to the Department of Defense and the federal government as a whole. This DFARS audit is the first step in ensuring that suppliers are, in fact, compliant with the DFARS mandate and NIST SP 800-171. While the DCMA will only be directly assessing the primes and possibly their tier-one suppliers, the Department of Defense audit will surely have a ripple effect through the entire supply chain adn will require suppliers to engage in audit planning and other internal audit management activities to support air-tight information security in accordance with DFARS 800-171. Regardless of where you sit in the supply chain, DFARS compliance is no longer a matter of winning business, and having proper audit reports on hand is critical, a functionality that audit management software can automate for teams. We are now to the point where DFARS compliance is a matter of losing business, and not just for you but for your partners as well.

 

About The DFARS Mandate

The federal government is relying on external services to help carry out a wide range of federal missions as well as business functions. Many federal contractors and subcontractors “routinely process, store, and transmit sensitive federal information in their information systems to support the delivery of essential products and services to federal agencies.” With that being said, the contractor community has to provide assurance to DoD that their IT system can offer a high level of security to protect this sensitive information. If any contractor fails to do so, they can inevitably lose their contracts.

The document details requirements for protecting Controlled Unclassified Information (CUI) when:

  1. The CUI is resident in nonfederal information systems and organizations
  2. The information systems where the CUI resides are not used or operated by contractors of federal agencies or other organizations on behalf of those agencies
  3. Where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category or subcategory listed in the CUI Registry

In practical terms, although companies that work with the DoD already apply rigorous controls over classified data, now the protection is extended to the unclassified systems that include covered defense information, which creates wider-reaching consequences for the DoD contractors. Being compliant can determine the future of businesses, which is why many organizations are turning to integrated risk management solutions with audit management software use cases.

Run a DFARS security assessment: This can help to have a clear vision of where your organization stands, and if you are in compliance with all the requirements. Download the guide to know what's required.

Implementation: Once you identified all the deficiencies in your IT system, you need to create a plan to help you complete the implementation. It should protect all the sensitive defense information as well as strengthen your system. Your POAM & SSP are crucial to documenting this step.

Partner with a third party: Finding a trustworthy and experienced company to run your assessment, ease the process, and monitor and document continuing compliance. NIST SP 800-171 compliance is a dynamic process and the ongoing compliance process can be taxing for contractors. Outsourcing overall cybersecurity risk, compliance, and internal audit management is a very viable option.  Reaching compliance is just the start, but maintaining compliance is key. Contact CyberSaint to learn about our trusted partners for DFARS compliance.

Get a Demo of CyberStrong’s audit management software capabilities to learn how to get your assessment, compliance documents and policies in order to keep existing contracts, and certainly before you try and win contracts in the future. You'll be able to weigh the costs and impacts of complying to DFARS and will give you the most effective path to compliance and risk management success. CyberStrong exports your compliance documents for audit with the click of a button, and is the platform within which you'll prove continuous compliance for all your contracts in-house, while benefiting from increased risk visibility, communication, and measurement from within an audit management software solution.

You may also like

Informing Cyber Risk Management ...
on May 18, 2023

Cybersecurity is no longer just an IT issue but a business risk that can impact an organization's reputation, financial health, and legal compliance. Cybersecurity risks are ...

Is Your Organization Prepared for ...
on May 3, 2023

Data storage, as well as maintenance tools and applications, have undergone many iterations in the past decade, with the introduction of cloud computing and Security Information ...

Strategies for Automating a Cyber ...
on May 8, 2023

Cybersecurity leaders and teams are overburdened by several growing trends and issues. And when your cybersecurity team is overworked and unequipped to manage cyber risk ...

Selecting the Right Cyber Risk ...
on April 13, 2023

Cyber risk quantification is the process of determining the likelihood and potential impact of a cyber attack or security breach. The probability and impact will vary based on ...

Leveraging Cyber Security ...
on May 26, 2023

A common misunderstanding with cyber risk management is that only the CISO and security practitioners should be concerned about cyber and information security. Instead, the state ...

Tips and Tricks to Transform Your ...
on April 12, 2023

Simply being “cyber aware” is an unviable option for board members as the impact of cybersecurity expands beyond IT systems. An unnoticed security gap or dated risk assessment are ...