On January 30, 2020, the U.S. Department of Defense (“DoD”) released Version 1.0 of its Cybersecurity Maturity Model Certification (“CMMC”) framework (CMMC overview here; CMMC Version 1.0 and appendices here). By 2026, DoD plans to require CMMC certification for all defense contracts. For companies looking to play a role – any role – in the defense industry supply chain, now is the time to develop, assess, and augment cybersecurity practices.
Harry is experienced in areas such as CFIUS/Exon-Florio examinations of foreign investment, military and “dual use” export control regulations (ITAR/EAR), economic sanctions administered by the U.S. Treasury Department (OFAC), customs regulations, the Foreign Corrupt Practices Act, anti-money laundering rules, anti-boycott requirements and defense industrial security requirements. He executes internal corporate investigations regarding trade and investment rules and advises on such rules in the context of corporate transactions.
Additionally, Harry has extensive experience with government contracting matters. His government contracting work has included, for example, design and implementation of U.S. Defense Department renewable energy projects. He also represents broad industry coalitions on major trade litigations and international negotiations. His experience in these areas includes a leading role in what is often considered the largest-ever international trade dispute: the controversy regarding unfair softwood lumber imports from Canada. It has involved myriad administrative proceedings before federal agencies, NAFTA panel appeals, WTO dispute proceedings, judicial proceedings and international settlement agreements.
Harry has represented a coalition of major U.S. oil companies in antidumping and countervailing duty litigation. As a related matter, he pursues policy issues with congressional and executive branch officials and advises on international trade rules (e.g., GATT, WTO agreements and NAFTA).
Chambers Global recognizes Harry as a leader in the field of international trade law and has recognized him with special distinctions regarding the Foreign Corrupt Practices Act and export controls. He is also recognized by Chambers USA in the CFIUS Experts category. Clients note that Harry provides "on-point and assertive responses" and is "constantly thinking in business terms."
Posts by: Harry Clark
For businesses that work with the U.S. Department of Defense (“DoD”), two important rules for safeguarding certain categories of sensitive information and reporting cyber incidents were recently finalized, updating the interim rules promulgated in late 2015. The first rule amends the Defense Federal Acquisition Regulation Supplement (“DFARS Rule”) and went into effect on October 21, 2016. The second rule modifies the previously voluntary DoD cybersecurity information-sharing program in connection with the Defense Industrial Base (“DIB Rule”) and went into effect on November 3, 2016.
We previously explained the changes brought about by the interim rules. Here, we explain what changed after the rules’ comment periods, and provide suggestions for compliance.
Even today, most companies—even technology companies—do not think they have information that the U.S. Government wants or needs, particularly as it might relate to a national security investigation. The reality is that as terrorists and others who threaten national security use a broader spectrum of technology resources to communicate and to finance and conduct operations, the U.S. Government has significantly increased its collection of data from technology companies and others.
On December 30, 2015, DoD published an interim rule, effective immediately, amending portions of the August Rule. Most importantly, pursuant to the new rule, contractors administering covered information systems that are not being operated on behalf of the government now have until December 31, 2017 to implement the new NIST SP 800-171 standards. Previously, through a class deviation, contractors were given an additional nine months after contract award to comply with the multifactor authentication provisions of NIST SP 800-171. The new December 31, 2017 deadline gives contractors significantly more time to implement all of the requirements of NIST SP 800-171.
The United States Department of Defense (“DoD”) recently published two new rules that impose broader obligations to safeguard information that falls within specified categories of sensitive data and to report cyber incidents to the government. These rules generally apply to companies that have been awarded new DoD procurement contracts, that hold subcontracts under such DoD contracts, or, in some cases, that have been awarded other types of agreements with DoD. The rules:
- expand contractors’ and subcontractors’ safeguarding responsibilities and obligations to report and investigate cyber threats;
- modify the scope of data that contractors and subcontractors must safeguard and the universe of contractors and subcontractors to which the requirements apply;
- establish requirements for contractors and subcontractors using cloud computing to provide information technology services to DoD, including requiring such contractors to keep government data within the United States, implement DoD-approved safeguards, and limit disclosure of and access to government data;
- expand and make mandatory DoD’s previously voluntary cyber incident reporting system for defense industrial base (“DIB”) agreement holders; and
- open DoD’s voluntary cybersecurity information sharing program up to a greater range of agreement holders.
The new rules reflect DoD’s intensified focus on treatment of export controlled technology and other categories of sensitive data. Awardees of DoD procurement contracts, subcontracts, and other types of instruments such as cooperative agreements are well-advised to make their data-security and export control compliance programs comport with these new requirements.