Supplier Cybersecurity

Minimizing cyber risks for our clients and partners

As technology becomes even more critical to the acquisition process, cybersecurity is at the forefront of everyone鈥檚 mind.鈥抻谴� is taking steps to ensure that our data and internal systems are protected and compliant with applicable laws and regulations. We also must ensure that the data within our subcontractors' control, and transmitted by our subcontract to others, is protected and compliant with these same laws and regulations.

It is critical that our subcontractors can protect all forms of sensitive data. As a firm, we are taking a proactive approach to minimize cybersecurity risks to our national security and government听clients. Prime Contractors that are not compliant with these cybersecurity requirements (in particular the听DFARS cybersecurity requirements) risk losing further contracts awards, as well as possible impacts to existing contracts.听

It is imperative that our suppliers are aware of鈥痶he requirements related to DFARS 252.204-7012, NIST SP 800-171, and the Cybersecurity Maturity Model Certification (CMMC) process.

Safeguarding Controlled Unclassified Information (CUI)

In 2017, the Department of Defense (DOD) implemented requirements to enhance the protection of controlled unclassified information (CUI) within the supply chain (DFARS 252.204-7012 and the NIST 800-171). In addition to the reporting requirement, DOD set standards to protect CUI, as recommended by the National Institute of Standards and Technology (NIST) and expected the supplier community to do the same.鈥�

However, over time, the DOD Office of Inspector General found that DOD suppliers were not consistently implementing the mandated requirements for safeguarding CUI. This was partly because DOD relied solely on suppliers to self-report their progress. Thus, DOD implemented a "trust but verify" policy (as espoused by DFARS 252-7019 and -7020) requiring suppliers to complete a self-assessment based on the NIST 800-171 controls and to send their score to the听

FREQUENTLY ASKED QUESTIONS FOR SUPPLIERS

What is the definition of Covered Defense Information (CDI)?

鈥淐overed defense information鈥� is听CUI, as described in the听听that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and听government-wide policies鈥攁nd is either:

Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DOD in support of the performance of the听contract, OR
Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

鈥疻here can I find the NIST 800-171 requirements?

The full听requirements can be found in the NIST publication:听

What is the purpose of DFARS clause 252.204-7012, -7019 and -7020?

听was structured to ensure that unclassified DOD information residing on a contractor鈥檚 internal information system is safeguarded from cyber incidents, and that any consequences associated with the loss of this information are assessed and minimized via the cyber incident reporting and damage assessment processes.听

听

In addition, by providing a single DOD-wide approach to safeguarding covered contractor information systems, the clause prevents the proliferation of cybersecurity clauses and contract language by the various entities across DOD.听

听

DFARS clause 252.204-7019 and -7020 ensures that prime contractors and subcontractors who create, store, or transmit CUI within their covered information systems and network have done a NIST SP 800-171, Rev. 2 assessment within the last three years and registered it in the DoD SPRS system. 听By doing so, suppliers and the government understand how their covered information system compares to the NIST SP 800-171, Rev.2 standard for protecting CUI.

What is the Supplier Performance Risk System (SPRS)?

The听听is a shared data warehouse that听provides storage and access to the NIST SP 800-171 assessment scoring information. This database contains听the听NIST SP 800-171 assessment date, score, scope, and plan-of-action completion date for every vendor location,听identified by their Commercial and Government Entity (CAGE) code. Vendors can view their own data and those with the 鈥淪PRS Cyber Vendor User鈥� role can manage their basic assessment scores.听鈥�

Understanding the Cybersecurity Maturity Model Certification (CMMC)鈥�2.0

The Cybersecurity Maturity Model Certification (CMMC) is a DOD program designed to safeguard sensitive national security information by ensuring that DOD contractors and subcontractors meet the requirements to safely handle CUI.

DOD first released the CMMC in September 2020 and announced CMMC 2.0 in November 2021.

Requirements for Software Suppliers (OMB-22-18)

In September 2022, OMB announced mandatory compliance requirements for all federal software suppliers. Memorandum M-22-18 requires all federal agencies and their software suppliers to comply with NIST supply chain security frameworks and supply chain security guidance and includes a timeline for compliance with the rules. The memo requires that software producers/providers give self-attestation that their software or major upgrade follows two NIST framework/security guidance before federal agencies can start using it.听 In addition, a software bill of materials could also be required.

Additional Resources for Suppliers

鈥�

A 鈥痺ebsite that provides trusted resources to assist听Defense Industrial Base (DIB) companies and suppliers of varying sizes with the implementation of cyber protections, and awareness of cyber risk, regulations, and accountability for their supply chain.鈥�

无忧传媒 Supplier Cybersecurity information听(PDF)鈥�

A publication created by 无忧传媒听to help inform suppliers and small businesses听on听the new rules of cybersecurity, the new cybersecurity environment, and the CMMC framework.

A听DHS tool to help evaluate your organization's industrial control system and information technology and develop your Systems Security Plan (SSP).鈥�

CMMC Requirements Notification (October 2020 Memo)鈥�

鈥疉 memo from 无忧传媒 to suppliers on compliance enforcement of the protection of controlled unclassified information (CUI)鈥痮f鈥� defense contractors by the Department of Defense (DOD)鈥�.听

鈥�

Requirements for safeguarding covered defense information (CDI) and cyber incident reporting.鈥�

Requirements of implementing NIST SP 800-171 controls, assessing their systems against the NIST controls to protect CUI, and registering their assessment score with DOD before prime contractors are eligible for DOD awards.

Requirements that (1) federal contractors provide access to facilities and personnel to allow the Government to do Medium- and High-level assessment against NIST SP 800-171 controls and (2) flowing the NIST SP 800-171 controls implementation, assessment, and registration requirements to a federal contractor鈥檚 supply chain to protect CUI.

DOD CIO website about the CMMC project to protect the Defense Industrial Base鈥檚 use of CUI from frequent cyber attacks.

Framework that software providers/producers must follow before implementing software or major software upgrades at federal agencies.

Security guidance that software providers/producers must follow before implementing听software or major software upgrades at federal agencies.

Article

1 - 4 of 8

无忧传媒