On December 30, 2015, DoD published an interim rule, effective immediately, amending portions of the August Rule. Most importantly, pursuant to the new rule, contractors administering covered information systems that are not being operated on behalf of the government now have until December 31, 2017 to implement the new NIST SP 800-171 standards. Previously, through a class deviation, contractors were given an additional nine months after contract award to comply with the multifactor authentication provisions of NIST SP 800-171. The new December 31, 2017 deadline gives contractors significantly more time to implement all of the requirements of NIST SP 800-171.
The United States Department of Defense (“DoD”) recently published two new rules that impose broader obligations to safeguard information that falls within specified categories of sensitive data and to report cyber incidents to the government. These rules generally apply to companies that have been awarded new DoD procurement contracts, that hold subcontracts under such DoD contracts, or, in some cases, that have been awarded other types of agreements with DoD. The rules:
- expand contractors’ and subcontractors’ safeguarding responsibilities and obligations to report and investigate cyber threats;
- modify the scope of data that contractors and subcontractors must safeguard and the universe of contractors and subcontractors to which the requirements apply;
- establish requirements for contractors and subcontractors using cloud computing to provide information technology services to DoD, including requiring such contractors to keep government data within the United States, implement DoD-approved safeguards, and limit disclosure of and access to government data;
- expand and make mandatory DoD’s previously voluntary cyber incident reporting system for defense industrial base (“DIB”) agreement holders; and
- open DoD’s voluntary cybersecurity information sharing program up to a greater range of agreement holders.
The new rules reflect DoD’s intensified focus on treatment of export controlled technology and other categories of sensitive data. Awardees of DoD procurement contracts, subcontracts, and other types of instruments such as cooperative agreements are well-advised to make their data-security and export control compliance programs comport with these new requirements.