FED GOV CON Webinar Wednesdays 2019 Series JSchaus & Assoc. Washington DC +1–202–365–0598
About Our Webinars: - Every Wednesday; - Complimentary; - Recorded; - YouTube & our Website; - No Questions
About Us:
Professional Services for Federal Contractors - GSA Sched; - SBA 8(a); - Proposal Writing; - Pricing; - Contract Administration; - Business Development
ur THURSDAY - April 18 CONFERENCE: 29th Annual Procurement Con ference TUESDAY - May 8 CONFERENCE: 7th Annual Reston Chamber B2G Matchmaking TUESDAY - Aug 6 IN-PERSON CLASS: Intro To GSA Schedules
Advertise With Us! We offer newsletter & webinar advertising. CONTACT: Mallory.Flowers@ jenniferschaus.com for more information.
About Our Speaker: Johana Reed Education: J.D. Georgetown University Company Name: McMahon, Welch, & Learned PLLC # of Years Federal Gov Con Experience: Over 30
Cybersecurity Under the Defense Federal Acquisition Regulation Supplement (DFARS)
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
FISMA – There are actually 2 acts that use this acronym – Federal Information Security Management Act of 2002 Federal Information Security Modernization Act of 2014 FISMA imposes basic information security requirements upon federal agencies – and many contractors – that have been fleshed out in much greater detail by policies and standards issued by the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST). However, only the Department of Defense has issued procurement regulations regarding the imposition of basic information security requirements on its contractors.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Two Primary DFARS Clauses: DFARS 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls
252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
DFARS 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls (Oct 2016) Requires offerors to represent that it will implement NIST 800-171 standards that are in effect at the time the solicitation is issued, but no later than December 31, 2017. Requires that the security requirements required by 252.204-7012 shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
(a) Definitions. As used in this provision— “Controlled technical information,” “covered contractor information system,” “covered defense information,” “cyber incident,” “information system,” and “technical information” are defined in clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. (b) The security requirements required by contract clause 252.204-7012, shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see 252.204-7012(b) (2)— (1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer not later than December 31, 2017.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
(2)(i) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of— (A) Why a particular security requirement is not applicable; or (B) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
(ii) An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (Oct 2016) (a) Definitions. As used in this clause— “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information. “Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company. “Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions. “Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information. “Covered defense information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Information (CUI) Registry at http://www.archives.gov/cui/registry/categorylist.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is— (1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or (2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein. “Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. “Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data— Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Summary of Requirements: Does not include all DoD contracts, only those that involve covered defense information. Self-certification that you meet all 110 standards in NIST SP 800-171. Required to be implemented as of December 31, 2017. Cyber incidents must be reported to the USG within 72 hours. Mandatory flowdown to subcontractors.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
CUI Regulatory Background Executive Order 13556 (2010): President Obama directs executive branch to promote standardization and reduce conflicting guidance Over 100 forms of legacy markings (e.g., FOUO, SBU, Restricted); agency-by-agency requirements. Establishes an open and uniform program for managing unclassified information that requires protection by law or government-wide policy Designates National Archives & Records Administration (NARA) as Executive Agent.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
NARA Final Rule (32 C.F.R. Âś 2002) Establishes policy for designating, safeguarding, marking, decontrolling, and disposing of CUI Among other facets of the CUI program Effective November 14, 2016 Applies directly to executive agencies But federal government remains obligated to ensure controlled information is protected when shared outside of government.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
NARA and CUI Program Standardize the more than 100 different markings currently used by agencies. Develop a publicly available CUI Registry to identify 23 discrete categories and 82 subcategories of CUI. Standardize markings for CUI and mandate their use when disseminated outside the Government. Identify and establish the CUI de-control authority and process. Requires agencies to protect CUI using National Institute of Standards and Technology (“NIST”) Standards, including Federal Information Processing Standards (“FIPS”) 199 and NIST Special Publication (“SP”) 800-53.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
CUI Registry 23 CUI Categories (plus 84 Subcategories) Agriculture
CTI
Critical Infrastructure
Financial
Geodetic Product Information Law Enforcement Privacy Tax
Immigration
Int’l. Agreements Patent Statistical
Legal Procurement & Acq. Transportation
Emergency Management IS Vulnerability Info.
Export Control
NATO Prop. Bus. Info.
Nuclear SAFETY Act Info.
Intelligence
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Safeguarding CUI Basic – moderate confidentiality impact Both a minimum and maximum control. Less than “moderate” control = not CUI Agencies may not control CUI Basic information at a level higher than moderate when disseminating outside the agency, unless by formal agreement (e.g., FAR clause) For Contractors NIST SP 800-171 defines requirements CUI Specified – Part 2002 does not identify specific controls required.
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Marking Uniform Marking Requirements “CONTROLLED” or “CUI” in top banner, similar to classified markings; may include category and dissemination markings CONTROLLED//SP-NNPI//NOFORN CUI//CRITICAL INFRASTRUCTURE
2019 – Fed Gov Con Webinar Series - Washington DC JSchaus & Associates
Government responsible for marking, but absence of marking does not eliminate control requirement Contractors handling controlled information expected to know what is controlled When in doubt, contact the disseminating agency Holders may challenge designation
THANK YOU! JSchaus & Assoc.
Washington DC hello@JenniferSchaus.com www.JenniferSchaus.com +1–202–365–0598 Speaker: Johana Reed Email: Jreed@mwllegal.com Phone: 703 483-2818