HACKED: 5 THINGS TO KNOW ABOUT NEW DOD CYBERSECURITY REGULATIONS

In 2007, a preeminent American defense contractor first reported cyber attacks emanating from China. Four years later, upon a visit by then Secretary of Defense Robert Gates, the Chinese Air Force revealed a fighter jet unnervingly similar to the one manufactured by the hacked American contractor. More recently, the FBI reported in July 2015 that hackers accessed the personnel files and security clearances of over 22 million federal employees and contractors.

Accordingly, the Department of Defense (DOD) moved to strengthen the Defense Federal Acquisition Regulation Supplement (DFARS) concerning cybersecurity. The interim rule alters the contractual duties of government contractors and subcontractors in a significant manner. Thus, every government contractor and subcontractor ought to consider the following 5 highlights of the interim rule.

(1) Seriousness. The regulation is effective immediately. The DOD invoked “urgent and compelling reasons” to impose the change without the typical comment period. The comment period before final form remains open until October 26, 2015, however.

(2) Scope. First, the interim rule requires “adequate security” from “unauthorized access and disclosure,” an imposition yet undetermined in breadth. Second, the addition compels contractors to report to the DOD any cyber incident “adverse or potentially adverse” to the contractor’s information technology (IT) systems. The scope of what defines “adverse or potentially adverse” is unknown. Once a contractor or subcontractor reports an incident, the company must make all affected “media” available to government inspection. This includes physical devices such as laptops and cell phones as well as paper archives.

The DOD did clarify that the rule includes contracts for commercial items. Likewise, it covers non-confidential and proprietary information. Regulations applicable to confidential data remain unchanged. 

(3) Speed. The new regulation requires contractors and subcontractors to report cyber incidents within 72 hours of the attack.  The contractors owe their report to the DOD while the subcontractor must account to the prime contractor and to the DOD. Fortunately, though, the DOD will not consider such reporting, by itself, as evidence that a company has failed the rule’s security requirements.

(4) Savings? The DFARS modifications are similar in language and intent to those of another federal agency, one created specifically for IT security. As such, the interim rule is “tailored for use in protecting sensitive information residing in contractor information systems,” which could indicate potential savings for certain companies. Other companies, however, especially those without IT departments or IT experts, could experience increased costs. The DOD even admits that some 10,000 small businesses will require the help of IT experts to decipher cyber incidents, to determine the information affected, and to author the government report.  

(5) Service impact. Many contractors and subcontractors are moving their IT services to cloud computing. The interim rule applies to cloud computing, too. In fact, it compels companies to monitor their cloud to confirm the appropriate “administrative, technical, and physical safeguards.”

The broad nature of these DOD security requirements necessitates a precise and professional approach for government contractors. Vandeventer Black's Construction and Government Contracts Team attorneys are poised to help navigate those needs for our clients. Please visit the firm's website to learn more about the firm and our professionals at www.vanblacklaw.com.