• Home
  • IT Risk Management & Compliance
    • CMMC Assessment & Preparation
    • NIST SP 800-171 / DFARS Compliance
    • FISMA Compliance
    • GDPR Compliance
  • Managed Cyber Security
  • Managed IT Services
  • Who We Are
    • Careers
  • Resources
    • CMMC 2.0 Updates Guide
    • CMMC News
    • CMMC Guide for DoD Contractors
    • NIST 800-171 Guide
    • DFARS Interim Rule Guide
    • DFARS Compliance Guide
    • FISMA Compliance Guide
  • Blog
  • Help Desk
  • Free Consultation
  • Contact Us

Support: 800-699-0925 Sales: 800-481-1984

SysArc

IT Company

  • Services
    • IT Risk Management & Compliance
      • CMMC Assessment & Preparation
      • NIST SP 800-171 / DFARS Compliance Solution
      • NIST 800-53 Compliance Solution
      • FISMA Compliance Solution
      • GDPR Compliance Solution
    • Microsoft GCC/GCC High Migration Services
    • Managed Cyber Security
    • Managed IT Services
    • Managed IT Services for Government Contractors
    • SOC Services
  • Who We Are
    • Careers
  • Resources
    • Latest CMMC News
    • CMMC Guide for DoD Contractors
    • NIST 800-171 Guide
    • DFARS Interim Rule Guide
    • DFARS Compliance Guide
    • FISMA Compliance Guide
  • Case Studies
    • FN America
    • Honeycomb Company of America, Inc.
  • Blog
  • Help Desk
  • Free Consultation

The White House Releases Cybersecurity Guidance During Russian/Ukraine Conflict

April 11, 2022 by SysArc

The White House Logo

Click here to read the full statement and cybersecurity guidelines from the White House.

The White House has warned about the potential for Russia to engage in malicious cyber activity against the United States in response to the unprecedented economic sanctions we have imposed. To prepare, the White House, along with the Cybersecurity & Infrastructure Security Agency (CISA), has issued guidance for all organizations, including those in the private sector.

The guidance includes the following 8 security measures:

  1. Mandate MFA on all devices that have network access
  2. Ensure all software is patched and up to date
  3. Deploy security tools on your devices. For example, EDR and antivirus.
  4. Back up your data in a secure location
  5. Run exercises and drill your emergency plans
  6. Encrypt your data
  7. Train your employees with Security Awareness
  8. Engage with your local FBI field office or CISA regional office in advance of any cyber incidents

The Details of this Guidance

Here are explanations of each of the 8 security guidelines issued by the White House.

Mandate MFA on all devices that have network access

Multi Factor Authentication, or MFA for short, is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence. An example of MFA is requiring a user to provide a password and code via an SMS message to successfully login to a cloud application.

Ensure all software is patched and up to date

While not all up to date software programs are 100% secure at all times, developers work to ensure that any known security vulnerabilities are secured in their latest software updates. Cybercriminals can exploit these security vulnerabilities in out of date software. That’s why it is vital to ensure that all your devices’ operating systems and software have the latest versions installed.  

Deploy security tools on your devices

Ensure that you have Endpoint Detection & Response (EDR) as well as antivirus software on all the devices that have access to your network. Antivirus will scan your devices for any known computer viruses and malware. EDR will protect against unknown threats because they don’t rely on signatures like antivirus solutions do. Additionally, EDR provides visibility into all endpoint activity, which allows for a faster response to threats.

Back up your data in a secure location

A backup and disaster recovery (BDR) plan won’t protect your data from getting into the wrong hands, but it will help you recover better and faster from a cyber attack. For example, if you become the victim of a ransomware attack which holds your data and access hostage, a BDR plan will help you access a copy of your data in another secure location so you can restore your systems and circumvent the demands of the cybercriminal. 

Run exercises and drill your emergency plans

It’s a good idea to test your cyber incident response plans. For example, if your data is tied up in a ransomware attack, drill your team on the steps you’ll take to recover. Running exercises will make your team more prepared and less stressed when an actual event happens. After you run your drills, meet with your team to discuss how it went and ideas for improvements.

Encrypt your data

Encryption is the conversion of data from a readable format into an encoded format. Ideally, encrypted data can only be read or processed after it’s been decrypted by authorized parties.

There are encryption solutions for both file storage and sharing. 

Train your employees with security awareness

Security awareness training is a training program used by organizations to prevent and mitigate user risk. These programs are designed to help users and employees understand the role they play in helping to combat data breaches. For example, security awareness training can help an employee detect and respond to a phishing email before they unsuspectingly download a virus or give their login credentials over to a cybercriminal. 

Engage with your local FBI field office or CISA regional office in advance of any cyber incidents

Reporting cyber incidents is something we are very familiar with as it is a requirement for our clients who provide services for the U.S. Department of Defense. However, it’s still recommended for all types of organizations. Having a contact ready at your local FBI field office or CISA regional office will help you and authorities respond faster and more effectively to cyber attacks.

Where to Get Help

As a cybersecurity service provider specializing in securing DoD contractors’ information systems, we understand that many organizations lack the knowledge and resources to effectively implement the action items from the White House’s cybersecurity guidance. 

If your organization is having issues with implementing any of these measures, you might consider hiring a Managed Security Services Provider (MSSP), like SysArc, to help.  Our team of cybersecurity professionals will be able to assess your organization’s unique information systems and recommend solutions that secure your organization, while maintaining affordability, efficiency and productivity. 

For example, our CMMC compliance solution meets and exceeds the White House’s guidance and is based on the latest cybersecurity controls from the National Institute of Standards and Technology (specifically NIST 800-171) for Department of Defense contractors who store and transmit highly sensitive information.

If you’re a DoD contractor or an organization that is interested in attaining a similarly high level of cybersecurity, contact us today to get a free cybersecurity consultation.  

 

Filed Under: Cyber Security

How CMMC Combats the Rising Threat of Ransomware

October 6, 2021 by SysArc

ransomware and CMMCCommercial businesses and government organizations alike face a growing digital threat from Ransomware, more so now than at any time in recent memory. 

Ransomware is a type of malware that exploits vulnerabilities to encrypt devices, taking control of an organization’s computer systems and holding their data for ransom. These types of attacks have risen 150% in 2020, with the amount paid out by victims in ransoms increasing by over 300%.

Government agencies have been especially concerned with the threat ransomware poses; thousands of local government organizations have been affected by ransomware attacks, and sensitive information makes federal agencies significant targets as well. But non-government entities also form large targets and need to be proactive to protect themselves from this type of attack.

Ransomware Targets Intellectual Property

The Department of Defense (DoD) is especially concerned with the threat of ransomware since the DoD houses valuable intellectual property and controlled unclassified information (CUI). This concern extends to the private sector when private contractors work with the DoD and also must access this information to complete projects.

The Department of Defense needs contractors to be completely protected against potent malware such as ransomware so that the nation’s intellectual property isn’t compromised by bad actors.

Additionally, government contractors have their own intellectual property to protect, providing motivation for strengthening security beyond government mandates. 

These are just a few of the reasons why the DoD is tightening security requirements with CMMC.

Protecting Your Network with CMMC

CMMC is designed to protect the Department of Defense and its intellectual property by securing its supply chain, including ensuring that contractors working with the DoD have the proper level of security according to the type of data they need access to.

Full compliance with CMMC involves following strict controls outlined in NIST SP 800-171 Rev. 2 and NIST SP 800-172. These standards hold contractors to the task of implementing security measures that include limiting system access, protecting devices, implementing encryptions, monitoring and protecting company communications, and a host of other controls that, together, create a multi-layered, comprehensive security net designed to block ransomware and other cyber attacks.

Failing to reach these standards as a DoD contractor means that you won’t be eligible for government contracts—but even more importantly, if your security is lacking and you’re hit by a ransomware attack, your entire business could be compromised.

In 2020, the average remediation cost after a ransomware attack was $1.85 million—an expense that many businesses are unable to weather. 

The Power of Proactivity

Don’t wait for federal or industry regulations to order you to increase your security. Being proactive in updating your cybersecurity will provide long-term security benefits and give you a leg up as CMMC requirements are finalized and implemented.

Finally, here’s a word of caution: Don’t assume that your IT provider is already protecting against this threat unless you’ve specifically discussed it with them. Lots of people think their MSP is already covering their ransomware protection, but the truth is, your provider may not take action until they’ve seen the consequences after you’ve already fallen prey to an attack. Make sure you’ve discussed this service specifically so you understand exactly what’s being taken care of and what’s not.

Ransomware Prevention from SysArc

As we get closer to CMMC implementation, it’s important to remember that the reasons for CMMC aren’t just to protect the government’s data, it’s to protect your business and its assets as well.

Ransomware is a serious threat to all types of businesses, so even for contractors and businesses not associated with the government at all, securing systems against ransomware should be a priority. CMMC just provides a detailed framework for you to follow to achieve this level of security, giving you peace of mind.

SysArc is dedicated to protecting businesses and organizations from cyber threats including ransomware through implementation of the strongest available cybersecurity measures, including CMMC for DoD contractors. Get in touch today to learn how we can protect your business from cyber threats.

Filed Under: CMMC, Cyber Security

Now Is the Time for DoD Contractors to Focus on NIST 800-171

October 4, 2021 by SysArc

implementing NIST 800-171 in server roomAs CMMC continues to be reviewed internally by the DoD, NIST 800-171 is more important than ever. In this article, we’ll talk about the vital role NIST 800-171 plays in CMMC, and why it’s so important for DoD contractors right now.

The Delay of CMMC

The rollout of the Cybersecurity Maturity Model Certification framework was always expected to take several years, but now as it faces setbacks including significant changes in leadership,  small businesses voicing cost concerns, and a low number of accredited third-party assessors, it looks like full implementation may come later than expected.

However, the DoD is still concerned with fully protecting CUI right now, even before CMMC becomes a requirement. It can’t afford to leave vulnerabilities open while CMMC gets ironed out and implemented. That’s where NIST 800-171 comes into play.

NIST 800-171

While CMMC is still pre-implementation, NIST 800-171 remains an enforceable standard that contractors working with the Department of Defense must comply with. In fact, last year’s DFARS Interim Rule was set up specifically so that the DoD could enforce NIST while going through the transition to CMMC. Other government agencies are now also requiring compliance with NIST standards to different degrees.

Competitive Advantage of DFARS 7019 and 7020

Making sure you have your cybersecurity compliance program in place right now improves your competitive advantage because you’ll be eligible for contracts during the transition to CMMC. DFARS 7019 & 7020 is still currently enforceable and potentially auditable by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

Current Focus for DoD Contractor Security

Even though the CMMC rollout may be going more slowly than anticipated, now is not the time to be sitting still. Currently, DoD contractors wanting to be in a competitive position for contracts should be taking the following action when it comes to their security and compliance:

  • Perform a Readiness Assessment: A NIST 800-171 assessment performed by experienced cybersecurity professionals will deliver a gap analysis, an SPRS score, a System Security Plan (SSP), and a POA&M to show you the steps you need to take to become compliant with NIST 800-171 and reach all of the current DOD contract security requirements.
  • Get your SPRS score in: Reporting your self-assessment score to the Supplier Performance Risk System has been required since November 30, 2020. If you haven’t yet reported your score or completed remediation for any points missed, now is the time to do so.
  • Do the work for CMMC to gain maturity before the audit process: The first “M” in CMMC stands for Maturity—that means proving that your security systems have been compliant long enough to have matured. This could take six months to a year to gain maturity, and by then you may have to go through the audit process. You need to get your systems as compliant as possible now so that by the time CMMC contracts are available, you’ve demonstrated your established security systems over a period of time.

Work with SysArc

SysArc is a specialized IT provider that helps DoD contractors prepare for CMMC, comply with NIST 800-171, and navigate all federal security requirements and regulations along the way. To stay up to date with evolving compliance regulations and be fully prepared for the implementation of CMMC, contact SysArc today for a free consultation and a NIST 800-171 assessment.

Filed Under: CMMC, Cyber Security

Encrypted Email & File Sharing Solutions for CMMC Compliance

May 14, 2020 by SysArc

SysArc’s primary aim is to provide DoD suppliers with Cybersecurity Maturity Model Certification (CMMC) readiness services and solutions, which is why we have dedicated our efforts to finding affordable, easy-to-implement solutions for our clients. The solutions we offer—including PreVeil’s Encrypted Email and File Sharing Solution—are always designed to not only help your business pass compliance controls set forth in NIST 800-171, DFARS, and CMMC but also significantly reduce the risk of cyber attacks.

CEO of SysArc, Tim Brennan, says, “We are constantly seeking out best-in-class solutions for our customers to ensure they are prepared to meet CMMC regulations and other compliance requirements. PreVeil is one of the services we recommend because it meets our high standard of affordability and simplicity when it comes to implementation.”

With PreVeil, our customers get significant compliance support around email and file sharing for a lower cost, because there are no migration project costs involved and the service only needs to be implemented for users within the organization who handle CUI. In addition, we can easily implement the PreVeil Email & Drive service without the headache of migrating every email and file for all users, as is required with alternative products.


“A simpler, more affordable alternative to GCC High”

For an In-Depth Look: Download our CMMC Encrypted Email & File Storage White Paper
  • This field is for validation purposes and should be left unchanged.

“Our email and file encryption solution is a simpler, more affordable alternative to GCC High” -SysArc Cybersecurity Team


With its unique end-to-end encryption, PreVeil provides a higher level of IT security that protects your data, even if systems become breached or compromised. Our ability to easily implement such a highly valuable service at a reasonable cost makes it even more worthwhile for our customers. With such advantages, we are proud to recommend PreVeil as a reliable service for DoD suppliers who wish to optimize their security and achieve cybersecurity compliance.

For an in-depth look into how the PreVeil solution helps DoD suppliers meet the email and file encryption requirements of DFARS & CMMC, please contact a SysArc consultant today to schedule a demo.

Filed Under: Cyber Security

NIST SP 800-171 Rev. 1 Closely Resembles CMMC Level 3

January 23, 2020 by SysArc

Since the passing of the Defense Acquisition Federal Regulation Supplement (DFARS), many U.S. Department of Defense (DoD) suppliers have already implemented the NIST SP 800-171 (Rev. 1) cybersecurity controls required by the mandate.

However, with the upcoming release of Cybersecurity Maturity Model Certification (CMMC), many DoD contractors are concerned if they are properly prepared for certification with the implementation of NIST 800-171 (Rev. 1), and which CMMC maturity level that most closely resembles. This article aims to clear up some of that confusion and ease DoD supplier concerns.

Please note that the information presented in this article is based on draft version 0.7 of CMMC. We will update this article as the Office of the Under Secretary of Defense for Acquisition & Sustainment releases updated versions of CMMC.

NIST SP 800-171 Rev. 1 Closely Resembles CMMC Level 3

As outlined in the table graphic below, NIST SP 800-171 (Rev. 1) security controls (plus an additional 21 recently added “practices”) should be sufficient to certify contractors up to CMMC Level 3.

CMMC Level 3 Controls

Will CMMC Level 3 Be Enough for Your Company?

The DoD has stated that they believe that CMMC Levels 1-3 will sufficiently cover 95% of DoD contract requirements. If level 4 and 5 are required, contractors will need to implement additional controls including NIST SP 800-171 (Rev. B) plus an additional 24 practices to be certified at those levels.

Getting Help

If your company needs help implementing NIST SP 800-171 Rev. 1 controls, or the additional controls in Rev. B, we can help. We have helped over 50 DoD contractors throughout the world navigate the complexities and financial hurdles of the NIST requirements. We have worked closely with our customers to ensure they are compliant with DFARS 252.204-7012 and now we are working with them to achieve the CMMC certification level they need to be competitive in the industry. For more information, please visit our CMMC Readiness Page. If you’d like to speak with someone about preparing for a CMMC audit now, feel free to give us a call at (240) 453-4146 or schedule a CMMC Readiness Consultation now.

Filed Under: Cyber Security

SysArc Advocates a Simpler Process for CMMC Compliance Process

October 7, 2019 by SysArc

In a recent letter to the U.S. Department of Defense (DoD), SysArc, a U.S. based Managed Security Service Provider (MSSP), advocates on behalf of private DoD suppliers for a streamlined and cost-effective process for suppliers to comply with the Government’s mandated cybersecurity standards.

Since 2017, SysArc has focused primarily on helping small and mid-size DoD suppliers across the U.S. implement cybersecurity programs in their organizations in order to comply with DFARS / NIST 800-171 and, more recently, with the upcoming Cybersecurity Maturity Model Certification (CMMC). CMMC builds upon existing regulation (DFARS 252.204-7012) that is based on trust by adding a verification component with respect to cybersecurity requirements. SysArc’s dedicated team of cybersecurity experts have consulted with hundreds of DoD suppliers and gained a wealth of knowledge about the current challenges faced by these companies. The vast majority of the feedback they received from suppliers were concerns about the perceived costs associated with compliance and the complexity of deciphering the NIST 800-171 controls in order to understand exactly what it takes to meet the compliance standards.

To overcome these challenges, SysArc has worked over the last 3 years to significantly reduce the cost and complexity of getting companies to compliance by refining the assessment and remediation processes it uses to assist suppliers on compliance. This is what makes SysArc qualified to advocate on behalf of its DoD supplier customers and provide written comments regarding the Draft CMMC v0.4. SysArc will be doing the same when Draft CMMC Model v0.6 is released for public review in November 2019.

SysArc’s comments to the DoD with regards to the Draft CMMC v0.4 are summarized as follows:

  1. Ensure that the CMMC standards that many suppliers have already been working on (110 security controls of NIST 800-171) don’t change significantly or at all. Keeping the standards relatively the same will ensure suppliers can bid on 80-90% of DoD contracts and not have to incur additional costs by adding or modifying current controls.
  2. Provide advanced guidance to suppliers, before they go to get certified, on the CMMC Levels they are likely going to need to achieve in order to compete for the type of business they typically go after.
  3. Reduce technical jargon by using natural language where possible and to define some of the time constraints in the controls more definitively.
  4. Refrain from moving security controls from higher Levels of CMMC compliance to lower Levels, which makes it more difficult for suppliers to achieve compliance.

For more information about the Cybersecurity Maturity Model Certification and the Levels within it, please see SysArc’s guide to CMMC compliance written for DoD suppliers.

Filed Under: Cyber Security

CMMC Preparation is an “Allowable Cost” and Reimbursable by DoD

August 6, 2019 by SysArc

With the rollout of the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) requiring U.S. DoD contractors to become certified by meeting an appropriate level of cybersecurity standards, many DoD contractors are concerned with how they’ll pay for the costs associated with updating their systems and procedures.

DoD Contractor Cyber Security

Luckily, the DoD has announced that the costs to prepare for CMMC certification will be considered an “allowable cost.” Allowable costs are expenses specified in a contract that can be billed to the DoD. According to the CMMC website FAQ, “The cost of certification will be considered an allowable, reimbursable cost and will not be prohibitive.” The required CMMC level will be contained in sections L & M of the Request for Proposals (RFP). This means that DoD contractors will now be able to get reimbursement for CMMC Assessment and Preparation Services as well as the remediation work that needs to be done to meet the appropriate level of cybersecurity controls specified in each contract.

This comes as great news for U.S. companies, many of whom have struggled to navigate the hurdles of complying with DoD cybersecurity mandates over the last few years.

For more information on the CMMC and how to prepare for a CMMC Audit, see our Guide to CMMC preparation written specifically for DoD contractors. If you would like to speak with an expert now, please feel free to give us a call at (800) 481-1984 or schedule a CMMC consultation now.

Filed Under: Cyber Security

Meet DFARS Requirements and Scale Your Cyber Organization Faster

July 2, 2019 by SysArc

As the Department of Defense begins to crack down on the cybersecurity posture of its supply chain, ensuring compliance with the DFARS mandate and the National Institute of Standards and Technology (NIST) SP 800-171 specifically is becoming a top-of-mind concern for both technical and business side leaders. DoD contractors need to understand that 800-171 compliance is no longer about securing their own organization – but stopping infiltration of an entire node of federal agencies. Many manufacturers and contractors are faced with the challenge of allocating resources for these security requirements. While they may have achieved the necessary compliance standards in the time since the mandate went into effect, ensuring that the necessary audit trail and documentation is readily available is a completely different matter.

What is DFARS and NIST SP 800-171?

The federal government relies on external services to help carry out a wide range of federal missions as well as business functions. Many federal contractors and subcontractors “routinely process, store, and transmit sensitive federal information in their information systems to support the delivery of essential products and services to federal agencies.” With that being said, the contractor community has to provide assurance to DoD that their IT system can offer a high level of security to protect this sensitive information. If any contractor fails to do so, they can inevitably lose their contracts.

The document details requirements for protecting Controlled Unclassified Information (CUI) when:

  • The CUI is resident in nonfederal information systems and organizations
  • The information systems where the CUI resides are not used or operated by contractors of federal agencies or other organizations on behalf of those agencies
  • Where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category or subcategory listed in the CUI Registry
  • In practical terms, although companies that work with the DoD already apply rigorous controls over classified data, now the protection is extended to the unclassified systems that include covered defense information, which creates wider-reaching consequences for the contractors. Being compliant can determine the future of businesses.

There are fourteen families of security requirements to be SP 800-171 compliant to protect the confidentiality of CUI in nonfederal information:

  • Access Control
  • Audit and Accountability
  • Awareness and Training
  • Configuration Management
  • Identification and Authentication
  • Incident Response
  • Maintenance
  • Media Protection
  • Physical Protection
  • Personnel Security
  • Risk Assessment
  • Security Assessment
  • System and Communications Protection
  • System and Information Integrity

The Challenge Facing Many DFARS Contractors

Especially as the DoD moves out of a self-certification approach to ensuring 800-171 compliance, contractors need to ensure that they have resources consistently dedicated cyber. For many of these contractors that are not primes, the problem becomes resource constraints. Often, having an in-house compliance and risk team means creating an in-house compliance and risk team. Whether a contractor has an assigned information security team already in place or if they are exploring their options, DFARS compliance is too pertinent to wait. In many cases, outsourcing is a far more viable and economic option to achieve DFARS compliance and ensure that the SP 800-171 requirements are met.

Outsourcing DFARS Compliance

As we’ve said, meeting NIST 800-171 requirements is primarily about resource allocation – both time and money. For a majority of contractors, the most cost-efficient method to reaching and maintaining DFARS compliance is through a managed service provider. By supplementing your organization with a trusted outside security team, you can save your in-house resources for the necessary aspects of your business and spare months of training and a massive investment developing your own program.

By using a service provider that uses an AI backed solution like the CyberStrong platform, contractors also get the added benefit of scaling beyond the baseline of DFARS compliance. As more compliance requirements emerge and cyber risk becomes a greater concern for CEOs and the Board across all industries, having a solid foundation to build upon is a critical step. Augmenting your organization with a specialized information security team helps you scale faster and ensure that your business and revenue is secure.

Filed Under: Cyber Security

Reporting Cyber Incidents with the Department of Defense

April 25, 2019 by SysArc

This guide was written to help DoD contractors and subcontractors quickly understand what is required of them to take proper action after they either suspect or discover a cyber incident on their information systems in compliance with DFARS regulations.

If you need information about how to protect yourself from cyber incidents, rather, please see our guide on NIST 800-171 for DFARS Compliance.

What is a Cyber Incident?

According to section 252.204-7012 of DFARS Documentation, a cyber incident is defined as “actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on a DoD contractor’s information system and/or the information residing therein.” This broad definition includes actions that are taken by DoD contractors or subcontractors internally, and unauthorized outsiders, such as cyber criminals or foreign actors.

In simple terms, a cyber incident is any action taken, either internally or externally, that results in the compromise or potential compromise of a DoD contractor’s information system.

How to Know if There’s a Cyber Incident

Part of the DFARS regulation requires DoD contractors and subcontractors to implement and utilize cyber security monitoring tools. These tools may or may not have been implemented by your internal IT department, outsourced IT service provider, or a Managed Security Service Provider (MSSP) like SysArc. These monitoring tools would alert you of any compromise or attempt to compromise your information systems.

How to Report a Cyber Incident to the DoD

According to DFARS 204.7301 definitions, a cyber incident must be “rapidly reported” within 72 hours of your discovery of the incident. 204.7302 policy then states that DoD contractors and subcontractors must submit the following information via the DoD reporting website:

  1. A cyber incident report;
  2. Malicious software, if detected and isolated; and
  3. Media (or access to covered contractor information systems and equipment) upon request.

What information goes in the incident report?

DoD Contractors that are not providing Cloud Services

On the DIBNet Portal website, DoD contractors, except those providing cloud services, are required to submit as much as the following 20 items of information as possible:

  1. Your company name
  2. Company point of contact information (address, position, telephone, email)
  3. Data Universal Numbering System (DUNS) Number
  4. Contract number(s) or other type of agreement affected or potentially affected
  5. Contracting Officer or other type of agreement point of contact (address, position, telephone, email)
  6. USG Program Manager point of contact (address, position, telephone, email)
  7. Contract or other type of agreement clearance level (Unclassified, Confidential, Secret, Top Secret, Not applicable)
  8. Facility CAGE code
  9. Facility Clearance Level (Unclassified, Confidential, Secret, Top Secret, Not applicable)
  10. Impact to Covered Defense Information
  11. Ability to provide operationally critical support
  12. Date incident discovered
  13. Location(s) of compromise
  14. Incident location CAGE code
  15. DoD programs, platforms or systems involved
  16. Type of compromise (unauthorized access, unauthorized release (includes inadvertent release), unknown, not applicable)
  17. Description of technique or method used in cyber incident
  18. Incident outcome (successful compromise, failed attempt, unknown)
  19. Incident/Compromise narrative
  20. Any additional information

DoD Contractors that are providing Cloud Services

For DoD Contractors providing Cloud Services on behalf of the Department of Defense, the DoD requires you to submit the following 16 items of information:

  1. Contract information to include contract number, USG Contracting Officer(s) contact information, contract clearance level, etc.
  2. Contact information for the impacted and reporting organizations as well as the MCND
  3. Details describing any vulnerabilities involved (i.e., Common Vulnerabilities and Exposures (CVE) identifiers)
  4. Date/Time of occurrence, including time zone
  5. Date/Time of detection and identification, including time zone
  6. Related indicators (e.g. hostnames, domain names, network traffic characteristics, registry keys, X.509 certificates, MD5 file signatures)
  7. Threat vectors, if known (see Threat Vector Taxonomy and Cause Analysis flowchart within the US-CERT Federal Incident Notification Guidelines)
  8. Prioritization factors (i.e. functional impact, information impact, and recoverability as defined flowchart within the US-CERT Federal Incident Notification Guidelines)
  9. Source and Destination Internet Protocol (IP) address, port, and protocol
  10. Operating System(s) affected
  11. Mitigating factors (e.g. full disk encryption or two-factor authentication)
  12. Mitigation actions taken, if applicable
  13. System Function(s) (e.g. web server, domain controller, or workstation)
  14. Physical system location(s) (e.g., Washington DC, Los Angeles, CA)
  15. Sources, methods, or tools used to identify the incident (e.g., Intrusion Detection System or audit log analysis)
  16. Any additional information relevant to the incident and not included above

Do you need further assistance?

For DoD contractors who need further consultation, please feel free to give us a call at (866) 583-6946, or read about our NIST 800-171 Services. We help DoD contractors and subcontractors all over the United States comply with DFARS using the NIST 800-171 cyber security framework.  

Filed Under: Cyber Security

What is “Adequate Security” for DFARS/NIST 800-171 Compliance?

March 27, 2019 by SysArc

We work with the Department of Defense (DoD) Contractors all over the United States and help them navigate the complexities of DFARS and NIST 800-171 compliance. One of the most common questions we get asked is what is meant by “Adequate Security” in the compliance requirements. “Adequate Security” is extremely vague, so it’s no wonder DoD Contractors have trouble understanding whether their current information security is adequate or not. We seek to clear up this confusion in this article.

Making Sense of The Official Language

According to section 252.204-7012 of DFARS documentation, “Adequate security” means protective measures that are put in place to mitigate the consequences and probability of loss, misuse, or unauthorized access to, or modification of information. The documentation proceeds to list out two scenarios for DoD Contractors and then provides the guidelines on protective measures for adequate security.

These scenarios are:

  1. Contractors that have information systems that are not part of an Information Technology (IT) service or system operated on behalf of the Government, and;
  2. Contractors that have information systems that are part of an IT service or system operated on behalf of the government

Scenario 1: Contractors with IT Systems that are not a part of or operated on behalf of the Government

For Contractors with IT Systems that are not part of an IT service or system operated on behalf of the Government, the information system must adhere to the security requirements in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (or NIST SP 800-171), at the time the contract solicitation is issued or as authorized by the Contracting Officer.

Complete documentation on NIST SP 800-171 controls is available here. If you need help implementing these controls, please see our NIST compliance services.

Scenario 2: Contractors with IT Systems a part of or operated on behalf of the Government

For Contractors with IT Systems that are part of an IT service or system operated on behalf of the Government, the requirements for adequate security are:

  1. Cloud Computing Security
    • If the Contractor indicated in its offer that it “does not anticipate the use of cloud computing services in the performance of a resultant contract,” in response to provision 252.239-7009, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract.
    • The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security Requirements Guide (SRG), unless notified by the Contracting Officer that this requirement has been waived by the DoD Chief Information Officer.
    • The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the Contracting Officer to use another location, in accordance with DFARS 239.7602-2(a).
  2. Any other such IT service or system (other than cloud computing) shall be subject to the security requirements specified in scenario 1 above.

DFARS Consultants are Available to Help

If you are a DoD Contractor and have any questions about DFARS and NIST SP 800-171, feel free to give us a call at: (866) 583-6946. Our DFARS Compliance specialists are happy to assist you in navigating the challenges of DFARS, and help you implement the security controls detailed in NIST SP 800-171.

Filed Under: Cyber Security

Next Page »

CMMC/DFARS Compliance Solution for Primes & Subcontractors

We’ve helped over 500 DoD Prime & Subcontractors throughout the U.S. navigate the complexities of DFARS, NIST 800-171, and now CMMC.

Large Prime Contractor Solutions:

  • - Supply Chain Risk Assessments
  • - Business Unit Readiness Assessment
  • - Cyber Compliance Remediation Services

SMB Supplier Solutions:

  • - CMMC Readiness Assessments
  • - Remediation Services
  • - Cyber Compliance as a Service

To speak with our team about your company’s needs or the needs of your suppliers, give us a call or request a consultation online now:

(866) 583-6946
or fill out the form below:

  • This field is for validation purposes and should be left unchanged.

Services

  • Managed Cyber Security
  • IT Risk Management & Compliance
  • Cybersecurity Maturity Model Certification (CMMC) Assessment & Preparation
  • NIST SP 800-171 / DFARS Compliance Solutions for DoD Contractors
  • Managed IT Support
  • Managed Cloud
  • Backup & Disaster Recovery
  • VoIP

Featured Articles

The White House Releases Cybersecurity Guidance During Russian/Ukraine Conflict

How CMMC Combats the Rising Threat of Ransomware

Now Is the Time for DoD Contractors to Focus on NIST 800-171

Encrypted Email & File Sharing Solutions for CMMC Compliance

NIST SP 800-171 Rev. 1 Closely Resembles CMMC Level 3

12300 Twinbrook Pkwy
Suite 500
Rockville, MD 20852

Sales: 800-481-1984

Customer Support: 800-699-0925 ext. 1

Quick Contact

Contact Us

CMMC RPO Badge

Navigation

  • Home
  • Services
  • Who We Are
  • Help Desk
  • Blog
  • Case Studies
  • Free Consultation
  • Careers
  • Contact Us

Follow Us

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

Featured Posts

Latest Posts

Client Case Study: CMMC Compliance for Honeycomb Company of America, Inc.

Driving Efficiency: How SysArc is Helping Companies Achieve CMMC Compliance

How SysArc Helped FN America Pass the Joint Surveillance Voluntary Assessment Program (JSVAP) with a Score of 110 

SysArc Helps Multinational Companies Build Microsoft GCC High Enclaves for Their U.S. Subsidiaries to Comply with CMMC

XDR: SysArc’s Answer to Modern Cyber Attacks

EDR vs. XDR: Understanding the Key Differences

SysArc © 2025. All Rights Reserved. Powered by Lemonade Stand. | Privacy Policy