FAQ: Cyber DFARS and government contracting

Introduction

The U.S. Department of Defense released a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) involving an update to cybersecurity safeguarding requirements for the protection of Covered Defense Information (CDI). DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (herein referred to as Cyber DFARS), requires contractors who handle CDI on non-federal systems in performance of contracts to implement adequate cybersecurity safeguarding controls and rapidly report cyber incidents to the federal government within 72 hours of discovery. The rule sets a Dec. 31, 2017, deadline for implementing adequate cybersecurity safeguarding controls.

This detailed FAQ provides an overview on Cyber DFARS with an exploration of its applicability, the requirements for cybersecurity controls and reporting on cybersecurity incidents.

Section I: Overview and applicability

1. What is DFARS 252.204-7012?

The Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” is a ruling which provides guidance to federal defense and aerospace contractors around protecting CDI and reporting cyber incidents affecting CDI or contractor information systems to the U.S. federal government. More specifically, it requires contractors who use CDI on non-federal systems to:

• Implement adequate cybersecurity safeguarding controls on all covered contractor information systems in accordance with specific frameworks and standards set forth in the ruling; and
• Rapidly report cyber incidents affecting contractor information systems or CDI residing within those systems to the federal government.

2. To whom does the DFARS 252.204-7012 ruling apply?

DFARS 252.204-7012 applies to any government contractors and their subcontractors, suppliers and/or partners that process, store or transmit CDI on covered contractor information systems in performance of a Department of Defense (DoD) contract. This includes any unclassified information that is provided by or on behalf of the DoD in connection with performance of the contract, or collected, developed, received, transmitted, used and stored by or on behalf of the contractor in support of the performance of the contract.