In a recent letter to the U.S. Department of Defense (DoD), SysArc, a U.S. based Managed Security Service Provider (MSSP), advocates on behalf of private DoD suppliers for a streamlined and cost-effective process for suppliers to comply with the Government’s mandated cybersecurity standards.

Since 2017, SysArc has focused primarily on helping small and mid-size DoD suppliers across the U.S. implement cybersecurity programs in their organizations in order to comply with DFARS / NIST 800-171 and, more recently, with the upcoming Cybersecurity Maturity Model Certification (CMMC). CMMC builds upon existing regulation (DFARS 252.204-7012) that is based on trust by adding a verification component with respect to cybersecurity requirements. SysArc’s dedicated team of cybersecurity experts have consulted with hundreds of DoD suppliers and gained a wealth of knowledge about the current challenges faced by these companies. The vast majority of the feedback they received from suppliers were concerns about the perceived costs associated with compliance and the complexity of deciphering the NIST 800-171 controls in order to understand exactly what it takes to meet the compliance standards.

To overcome these challenges, SysArc has worked over the last 3 years to significantly reduce the cost and complexity of getting companies to compliance by refining the assessment and remediation processes it uses to assist suppliers on compliance. This is what makes SysArc qualified to advocate on behalf of its DoD supplier customers and provide written comments regarding the Draft CMMC v0.4. SysArc will be doing the same when Draft CMMC Model v0.6 is released for public review in November 2019.

SysArc’s comments to the DoD with regards to the Draft CMMC v0.4 are summarized as follows:

1. Ensure that the CMMC standards that many suppliers have already been working on (110 security controls of NIST 800-171) don’t change significantly or at all. Keeping the standards relatively the same will ensure suppliers can bid on 80-90% of DoD contracts and not have to incur additional costs by adding or modifying current controls.
2. Provide advanced guidance to suppliers, before they go to get certified, on the CMMC Levels they are likely going to need to achieve in order to compete for the type of business they typically go after.
3. Reduce technical jargon by using natural language where possible and to define some of the time constraints in the controls more definitively.
4. Refrain from moving security controls from higher Levels of CMMC compliance to lower Levels, which makes it more difficult for suppliers to achieve compliance.

For more information about the Cybersecurity Maturity Model Certification and the Levels within it, please see SysArc’s guide to CMMC compliance written for DoD suppliers.

With the rollout of the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) requiring U.S. DoD contractors to become certified by meeting an appropriate level of cybersecurity standards, many DoD contractors are concerned with how they’ll pay for the costs associated with updating their systems and procedures.

Luckily, the DoD has announced that the costs to prepare for CMMC certification will be considered an “allowable cost.” Allowable costs are expenses specified in a contract that can be billed to the DoD. According to the CMMC website FAQ, “The cost of certification will be considered an allowable, reimbursable cost and will not be prohibitive.” The required CMMC level will be contained in sections L & M of the Request for Proposals (RFP). This means that DoD contractors will now be able to get reimbursement for CMMC Assessment and Preparation Services as well as the remediation work that needs to be done to meet the appropriate level of cybersecurity controls specified in each contract.

This comes as great news for U.S. companies, many of whom have struggled to navigate the hurdles of complying with DoD cybersecurity mandates over the last few years.

For more information on the CMMC and how to prepare for a CMMC Audit, see our Guide to CMMC preparation written specifically for DoD contractors. If you would like to speak with an expert now, please feel free to give us a call at (800) 481-1984 or schedule a CMMC consultation now.

As the Department of Defense begins to crack down on the cybersecurity posture of its supply chain, ensuring compliance with the DFARS mandate and the National Institute of Standards and Technology (NIST) SP 800-171 specifically is becoming a top-of-mind concern for both technical and business side leaders. DoD contractors need to understand that 800-171 compliance is no longer about securing their own organization – but stopping infiltration of an entire node of federal agencies. Many manufacturers and contractors are faced with the challenge of allocating resources for these security requirements. While they may have achieved the necessary compliance standards in the time since the mandate went into effect, ensuring that the necessary audit trail and documentation is readily available is a completely different matter.

What is DFARS and NIST SP 800-171?

The federal government relies on external services to help carry out a wide range of federal missions as well as business functions. Many federal contractors and subcontractors “routinely process, store, and transmit sensitive federal information in their information systems to support the delivery of essential products and services to federal agencies.” With that being said, the contractor community has to provide assurance to DoD that their IT system can offer a high level of security to protect this sensitive information. If any contractor fails to do so, they can inevitably lose their contracts.

The document details requirements for protecting Controlled Unclassified Information (CUI) when:

• The CUI is resident in nonfederal information systems and organizations
• The information systems where the CUI resides are not used or operated by contractors of federal agencies or other organizations on behalf of those agencies
• Where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category or subcategory listed in the CUI Registry
• In practical terms, although companies that work with the DoD already apply rigorous controls over classified data, now the protection is extended to the unclassified systems that include covered defense information, which creates wider-reaching consequences for the contractors. Being compliant can determine the future of businesses.

There are fourteen families of security requirements to be SP 800-171 compliant to protect the confidentiality of CUI in nonfederal information:

• Access Control
• Audit and Accountability
• Awareness and Training
• Configuration Management
• Identification and Authentication
• Incident Response
• Maintenance
• Media Protection
• Physical Protection
• Personnel Security
• Risk Assessment
• Security Assessment
• System and Communications Protection
• System and Information Integrity

The Challenge Facing Many DFARS Contractors

Especially as the DoD moves out of a self-certification approach to ensuring 800-171 compliance, contractors need to ensure that they have resources consistently dedicated cyber. For many of these contractors that are not primes, the problem becomes resource constraints. Often, having an in-house compliance and risk team means creating an in-house compliance and risk team. Whether a contractor has an assigned information security team already in place or if they are exploring their options, DFARS compliance is too pertinent to wait. In many cases, outsourcing is a far more viable and economic option to achieve DFARS compliance and ensure that the SP 800-171 requirements are met.

Outsourcing DFARS Compliance

As we’ve said, meeting NIST 800-171 requirements is primarily about resource allocation – both time and money. For a majority of contractors, the most cost-efficient method to reaching and maintaining DFARS compliance is through a managed service provider. By supplementing your organization with a trusted outside security team, you can save your in-house resources for the necessary aspects of your business and spare months of training and a massive investment developing your own program.

By using a service provider that uses an AI backed solution like the CyberStrong platform, contractors also get the added benefit of scaling beyond the baseline of DFARS compliance. As more compliance requirements emerge and cyber risk becomes a greater concern for CEOs and the Board across all industries, having a solid foundation to build upon is a critical step. Augmenting your organization with a specialized information security team helps you scale faster and ensure that your business and revenue is secure.

This guide was written to help DoD contractors and subcontractors quickly understand what is required of them to take proper action after they either suspect or discover a cyber incident on their information systems in compliance with DFARS regulations.

If you need information about how to protect yourself from cyber incidents, rather, please see our guide on NIST 800-171 for DFARS Compliance.

What is a Cyber Incident?

According to section 252.204-7012 of DFARS Documentation, a cyber incident is defined as “actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on a DoD contractor’s information system and/or the information residing therein.” This broad definition includes actions that are taken by DoD contractors or subcontractors internally, and unauthorized outsiders, such as cyber criminals or foreign actors.

In simple terms, a cyber incident is any action taken, either internally or externally, that results in the compromise or potential compromise of a DoD contractor’s information system.

How to Know if There’s a Cyber Incident

Part of the DFARS regulation requires DoD contractors and subcontractors to implement and utilize cyber security monitoring tools. These tools may or may not have been implemented by your internal IT department, outsourced IT service provider, or a Managed Security Service Provider (MSSP) like SysArc. These monitoring tools would alert you of any compromise or attempt to compromise your information systems.

How to Report a Cyber Incident to the DoD

According to DFARS 204.7301 definitions, a cyber incident must be “rapidly reported” within 72 hours of your discovery of the incident. 204.7302 policy then states that DoD contractors and subcontractors must submit the following information via the DoD reporting website:

1. A cyber incident report;
2. Malicious software, if detected and isolated; and
3. Media (or access to covered contractor information systems and equipment) upon request.

What information goes in the incident report?

DoD Contractors that are not providing Cloud Services

On the DIBNet Portal website, DoD contractors, except those providing cloud services, are required to submit as much as the following 20 items of information as possible:

1. Your company name
2. Company point of contact information (address, position, telephone, email)
3. Data Universal Numbering System (DUNS) Number
4. Contract number(s) or other type of agreement affected or potentially affected
5. Contracting Officer or other type of agreement point of contact (address, position, telephone, email)
6. USG Program Manager point of contact (address, position, telephone, email)
7. Contract or other type of agreement clearance level (Unclassified, Confidential, Secret, Top Secret, Not applicable)
8. Facility CAGE code
9. Facility Clearance Level (Unclassified, Confidential, Secret, Top Secret, Not applicable)
10. Impact to Covered Defense Information
11. Ability to provide operationally critical support
12. Date incident discovered
13. Location(s) of compromise
14. Incident location CAGE code
15. DoD programs, platforms or systems involved
16. Type of compromise (unauthorized access, unauthorized release (includes inadvertent release), unknown, not applicable)
17. Description of technique or method used in cyber incident
18. Incident outcome (successful compromise, failed attempt, unknown)
19. Incident/Compromise narrative
20. Any additional information

DoD Contractors that are providing Cloud Services

For DoD Contractors providing Cloud Services on behalf of the Department of Defense, the DoD requires you to submit the following 16 items of information:

1. Contract information to include contract number, USG Contracting Officer(s) contact information, contract clearance level, etc.
2. Contact information for the impacted and reporting organizations as well as the MCND
3. Details describing any vulnerabilities involved (i.e., Common Vulnerabilities and Exposures (CVE) identifiers)
4. Date/Time of occurrence, including time zone
5. Date/Time of detection and identification, including time zone
6. Related indicators (e.g. hostnames, domain names, network traffic characteristics, registry keys, X.509 certificates, MD5 file signatures)
7. Threat vectors, if known (see Threat Vector Taxonomy and Cause Analysis flowchart within the US-CERT Federal Incident Notification Guidelines)
8. Prioritization factors (i.e. functional impact, information impact, and recoverability as defined flowchart within the US-CERT Federal Incident Notification Guidelines)
9. Source and Destination Internet Protocol (IP) address, port, and protocol
10. Operating System(s) affected
11. Mitigating factors (e.g. full disk encryption or two-factor authentication)
12. Mitigation actions taken, if applicable
13. System Function(s) (e.g. web server, domain controller, or workstation)
14. Physical system location(s) (e.g., Washington DC, Los Angeles, CA)
15. Sources, methods, or tools used to identify the incident (e.g., Intrusion Detection System or audit log analysis)
16. Any additional information relevant to the incident and not included above

Do you need further assistance?

For DoD contractors who need further consultation, please feel free to give us a call at (866) 583-6946, or read about our NIST 800-171 Services. We help DoD contractors and subcontractors all over the United States comply with DFARS using the NIST 800-171 cyber security framework.  

We work with the Department of Defense (DoD) Contractors all over the United States and help them navigate the complexities of DFARS and NIST 800-171 compliance. One of the most common questions we get asked is what is meant by “Adequate Security” in the compliance requirements. “Adequate Security” is extremely vague, so it’s no wonder DoD Contractors have trouble understanding whether their current information security is adequate or not. We seek to clear up this confusion in this article.

Making Sense of The Official Language

According to section 252.204-7012 of DFARS documentation, “Adequate security” means protective measures that are put in place to mitigate the consequences and probability of loss, misuse, or unauthorized access to, or modification of information. The documentation proceeds to list out two scenarios for DoD Contractors and then provides the guidelines on protective measures for adequate security.

These scenarios are:

1. Contractors that have information systems that are not part of an Information Technology (IT) service or system operated on behalf of the Government, and;
2. Contractors that have information systems that are part of an IT service or system operated on behalf of the government

Scenario 1: Contractors with IT Systems that are not a part of or operated on behalf of the Government

For Contractors with IT Systems that are not part of an IT service or system operated on behalf of the Government, the information system must adhere to the security requirements in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (or NIST SP 800-171), at the time the contract solicitation is issued or as authorized by the Contracting Officer.

Complete documentation on NIST SP 800-171 controls is available here. If you need help implementing these controls, please see our NIST compliance services.

Scenario 2: Contractors with IT Systems a part of or operated on behalf of the Government

For Contractors with IT Systems that are part of an IT service or system operated on behalf of the Government, the requirements for adequate security are:

1. Cloud Computing Security
• If the Contractor indicated in its offer that it “does not anticipate the use of cloud computing services in the performance of a resultant contract,” in response to provision 252.239-7009, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract.
• The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security Requirements Guide (SRG), unless notified by the Contracting Officer that this requirement has been waived by the DoD Chief Information Officer.
• The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the Contracting Officer to use another location, in accordance with DFARS 239.7602-2(a).
2. Any other such IT service or system (other than cloud computing) shall be subject to the security requirements specified in scenario 1 above.

DFARS Consultants are Available to Help

If you are a DoD Contractor and have any questions about DFARS and NIST SP 800-171, feel free to give us a call at: (866) 583-6946. Our DFARS Compliance specialists are happy to assist you in navigating the challenges of DFARS, and help you implement the security controls detailed in NIST SP 800-171.

Broadly speaking, the U.S. Government defines Controlled Unclassified Information (CUI) as any information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

But how does this broad definition apply to Department of Defense (DoD) Contractors? More specifically, what is CUI with regards to the Defense Federal Acquisition Regulation Supplement (DFARS) and NIST 800-171? This short article will answer these questions for DoD Contractors.

CUI That Concerns DoD Contractors

As described in the CUI registry, CUI that pertains specifically to the DoD is known as Covered Defense Information. Covered Defense Information includes:

• Controlled Technical Information and;
• Contractor Attributional/Proprietary Information

Controlled Technical Information

According to section 252.204-7012 of DFARS Documentation, Controlled Technical Information means technical information with military or space application.

Examples of technical information include: research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

Contractor Attributional/Proprietary Information

The second type of Covered Defense Information is Contractor Attributional/Proprietary Information. According to 252.204-7012, this information identifies the contractor, whether directly or indirectly, by the grouping of information that can be traced back to the contractor (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

Protecting CUI

DFARS Policy 204.7302 states that Covered Defense Information is to be protected and monitored on the DoD Contractor’s information system(s), as well as the Department of Defense’s systems. Contractors are also required to rapidly report cyber incidents (actual or potentially compromised information) within 72 hours to the Department of Defense here.

More Guidance on CUI and How to Protect It

If you are a DoD Contractor and have any questions about CUI and how to protect it, feel free to give us a call at: (866) 583-6946. Our DFARS Compliance specialists are happy to assist you in navigating the challenges of DFARS, and help you implement the security controls detailed in NIST SP 800-171.

The Department of Defense’s final guidance requires the review of a System Security Plan (SSP) in the assessment of contract solicitation during the awards process. In other words, that means that DoD contracts will be assessed on the ability of the Contractor to provide proof of compliance with NIST 800-171. Without an SSP, DoD contractors may not be awarded any DoD contracts. Therefore, if your business relies heavily on contracts with the DoD, it is vitally important to create an SSP that meets all the requirements of NIST 800-171.

Use the following guidance to produce an SSP that allows your company to compete for DoD contracts and enjoy a smooth working relationship with the Department of Defense.

What is an SSP?

A system security plan or SSP is a document that identifies the functions and features of a system, including all its hardware and the software installed on the system. This document also defines the security measures that have been or will be soon put in place to limit access to authorized users, as well as to train managers, users and systems administrators in the secure use of the system. It includes details of processes for auditing and maintaining the system, in addition to information about how you plan to respond to security incidents that occur on the network. An SSP is a comprehensive summary of all security practices and policies that will help to keep DoD data secure if the contractor is awarded a DoD contract.

What Are Your Options for Writing an SSP?

NIST supplies a template to help contractors create an SSP. Some companies have their internal IT staff fill in this template to create a system security plan. This approach can work well if you are sure that your IT employees have the relevant knowledge and experience to create a comprehensive SSP. However, the disadvantage of creating an SSP in house is that it forces internal IT staff to take time away from their core duties, which could cause day to day operating difficulties for your business.

Another option for creating an SSP is to hire a NIST 800-171 consultant to do it for you. Many small DoD contractors shy away from this option because they assume it will be expensive, but in fact it can be much more cost-effective than trying to create your own SSP in house.

Which Option for Creating an SSP is Best For Your Business?

The advantage of working with a specialist NIST 800-171 consultant is that you can be sure that the SSP they create on your behalf will meet all the requirements set out in DFARS. Reputable IT companies that specialize in working with DoD contractors have a lot of experience of writing SSPs on behalf of businesses like yours, which means they are likely to be able to complete the job much more efficiently and effectively than your in house IT staff. All you have to do is ensure you choose a reliable IT company that has a strong background in helping DoD contractors meet the requirements of DFARS and NIST 800-171.

How to Get Started With Creating an SSP

Every contractor that hopes to win contracts with the DoD must produce an SSP that gives an overview of their systems and the security measures they have in place. To take the first step toward producing a robust SSP that can help your business compete for and win DoD contract awards, get in touch with SysArc today.

This a simple, straight-to-the-point guide on what DoD Contractors need to do to comply with NIST 800-171 quickly and effectively so that they can continue provide services to the Department of Defense. While this guide was written to be simple for company executives and management to understand, the requirements and language of 800-171 absolutely require either an experienced IT department or an outside consultant, such as a Managed Security Service Provider (MSSP) who specializes in DoD compliance.

A detailed guide specifically written for IT professionals is out of the scope of this guide. Fortunately, the National Institute of Standards and Technology (NIST) has already made available the documentation necessary for an experienced IT department to follow.

With that said, here’s what DoD Contractors need to do to comply with NIST 800-171…

The Documents: SSP & POA&M

As we recently reported, the Department of Defense has released its final guidance with respect to how DoD Contractors are to address DFARS/NIST 800-171 cyber security requirements during the contract award process. The guidance specifies the delivery of two documents by the DoD contractor:

1. Security Systems Plan (SSP) and;
2. Plan-of-Action and Milestones (POA&M)

These two documents serve as the basis for providing evidence of compliance with NIST 800-171 to the Department of Defense. While this is not an official requirement by the DoD, contractors who do not include these documents are at a severe disadvantage against contractors who are. Subcontractors who deal directly with Prime contractors may also find themselves required to provide proof of compliance to the Prime.

Security Systems Plan (SSP)

The Security Systems Plans goes over the DoD contractor’s approach for complying with the NIST 800-171 guidelines during the pre-contract phase and the security measures that they currently have in place. If the organization wants to continue doing business with the DoD, they need to ensure that the Security Systems Plans are up to par and formatted in a way that’s usable for the bidding process.

Options for Developing an SSP:

DoD Contractors have two options to develop a System Security Plan:

1. NIST SSP Template: DoD Contractors who have an internal IT Department who has cyber security knowledge can opt to develop an SSP in-house. The DoD has a SSP template available to assist in the process. To download the SSP template, click here.
2. Outsource to an MSSP: A Managed Security Service Provider who provides NIST 800-171 compliance services can develop the SSP for you for a fee. To view learn more about our compliance services for NIST 800-171, click here.

Plan-of-Action and Milestones (POA&M)

Compliance gaps identified during this process need a Plan-of-Action and Milestones on how the contractor intends on fixing the issues and what controls they’re putting in place that go beyond the minimum standard. The DoD uses NIST 800-171 as a baseline for the cybersecurity requirements that it wants to see from contractors working with CUI.

Options for Developing an POA&M:

DoD Contractors have two options to develop a Plan-of-Action and Milestones:

1. NIST POA&M Template: DoD Contractors who have an internal IT Department who has cyber security knowledge can opt to develop a POA&M in-house. NIST has a POA&M template available to assist in the process. To download the POA&M template, click here.
2. Outsource to an MSSP: A Managed Security Service Provider who provides NIST 800-171 compliance services can develop the POA&M for you for a fee. To view learn more about our compliance services for NIST 800-171, click here.

NIST 800-171: At the Heart of the SSP & POA&M

At the heart of both documents is the framework developed by the National Institute of Standards and Technology (NIST), known as NIST SP 800-171. The framework was designed to provide guidance on the best practices for protecting Controlled Unclassified Information (CUI), which is the objective of Defense Acquisition Federal Regulation Supplement (DFARS). Your IT network configuration and the way you handle CUI will need to comply with this framework.

NIST 800-171 Requirements

There are 14 primary requirements in this publication that the DoD contractor needs to account for when assessing their compliance efforts. Agencies that fail to comply with these security controls can find themselves missing out on DoD contracts.

• Access Control: Only a limited set of users and devices should have access to CUI.
• Awareness and Training: Everyone working at DoD contractors should have a role-appropriate awareness of the common cyber threats that can lead to a data breach.
• Auditing and Accountability: The DoD contractor’s systems should be capable of leaving a digital paper trail.
• Configuration Management: The wrong configuration can lead to many vulnerabilities, so a security-centric option is necessary.
• Identification and Authentication: The contractor’s systems need a way to confirm that users are who they claim to be.
• Incident Response: The DoD contractor should be prepared for common situations that could lead to the CUI being at risk of a breach.
• Maintenance: The DoD contractor’s information systems and infrastructure require proactive maintenance to remain up-to-date.
• Media Protection: Any media that stores CUI needs sufficient protection to protect it from breaches, along with procedures in place to wipe the media before destroying it.
• Personnel Security: The DoD contractors need to screen employees who are working with CUI and ensure that login information is not valid after someone leaves the organization.
• Physical Protection: Physical protection is required for the servers and hard drives that contain CUI.
• Risk Assessment: Regularly scheduled risk assessments keep the DoD contractor on top of any new risks to CUI.
• Security Assessment: Security audits are another important compliance measure in this publication.
• System and Communications Protection: The DoD contractor’s information systems need IT security measures that control all access of information and actively monitor for a potential intrusion.
• System and Information Integrity: The organization’s information systems should have sufficient defenses against malware, bugs and other vulnerabilities.

To view the complete documentation, please see “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” document provided by NIST.

Options for Meeting the Requirements

DoD Contractors have two options to meet the requirements:

1. IT Department: DoD Contractors who have an internal IT Department with cyber security knowledge and experience may be able to understand and implement the network environment and security protocols necessary to meet 800-171 security controls.
2. Outsource to an MSSP: A Managed Security Service Provider who provides NIST 800-171 compliance services will have an experienced team equipped with the tools and processes to help contractors meet the security controls. To view learn more about our compliance services for NIST 800-171, click here.

Technical Assistance is Available

We hope this guide gets you closer toward achieving NIST 800-171 compliance. If you have any questions about which options work best for your company, please feel free to give us a call at (866) 583-6946. We’ve helped DoD Contractors and IT departments all over the U.S. navigate the complexities of NIST 800-171. We’re more than happy to jump on the phone and point you in the right direction.

In December 2018, the Inspector General of the Department of Defense (DoD) released a report on the recent audit of the U.S. Ballistic Missile Defense System (BMDS). This audit found that security protocols that should protect networks and systems containing technical information about the BMDS were not put in place. While the audit was performed on the Department of Defense’s own systems, DoD Contractors now have the chance to learn from the audit and take action to ensure their compliance with the Department’s cyber security mandates such as DFARS.

Lessons for DoD Contractors

DoD contractors can use the released report to learn what they may expect if the DoD decides to audit their company’s System Security Plans (SSP). While there is no guarantee that this audit will be similar to the audits performed on DoD Contractors’ systems, they can still use the audit to gain insight into the criteria the DoD uses to assess Security System Plans and work out how to improve security measures and avoid making the same mistakes as BMDS.

Objectives of the DoD’s Security Audit

The key objective of the DoD’s security audit was to determine whether DoD Components implemented security controls and processes at DoD facilities. These security controls should protect BMDS technical information from both internal and external cyber threats.

Findings of the DoD’s Security Audit

In the failed audit, the DoD found that officials did not consistently implement security controls and processes to protect technical information regarding the BMDS. Some network administrators had not put in place multifactor authentication to secure access to BDMS technical information. This increases the chance that an experienced hacker could break into the systems and steal important classified information.

Three of the five Components that the DoD audited did not identify and mitigate known network vulnerabilities. They also, in many cases, did not consistently verify the effectiveness of the security controls they had implemented. Without careful consideration of the security risks and the adequacy or inadequacy of the security controls in place to protect against them, BMDS has no way of knowing whether they have taken enough action to keep their data safe.

Some auditors found that physical security at DoD facilities was inadequate. For example, server racks that are not locked up can be compromised by workers or intruders. Similarly, some officials failed to adequately protect classified data that was stored on removable media, which can easily fall into the wrong hands.

In addition, DoD auditors discovered failures to encrypt BDMS data when it was being transmitted. Some audited organizations also failed to put in place systems to detect attacks on classified networks, which means they could be unaware of threats.

Recommendations of the DoD’s Security Audit

The DoD audit report had four main recommendations to keep data safe at DoD facilities:

• Use multifactor authentication
• Respond quickly to vulnerabilities
• Protect data on removable media
• Implement the ability to detect intrusions, both on computer networks and in physical facilities

Options for DoD Contractors that are Selected for Audit

DoD contractors that are selected for audit must meet the recommendations that the audit report outlines. Contractors can choose to put the responsibility for meeting these requirements onto their in-house IT department, or seek the help of a cyber security consultant who specializes in NIST SP 800-171.

To handle security in house, contractors will need to use the guidelines given in the Self Assessment Handbook – NIST Handbook 162. The National Institute of Standards and Technology (NIST) created this handbook to help DoD contractors comply with all SP 800-171 security requirements. While this handbook is very useful, many contractors still find it difficult to handle all their security needs in house.

For many DoD contractors, working with a third-party Managed Security Service Provider (MSSP) is a better option than trying to handle DFARS compliance in house. Consultants who specialize in DFARS NIST SP 800-171 compliance know exactly how to meet the requirements and are therefore less likely than in-house employees to overlook security holes or make mistakes in the development and implementation of security protocols.

MSSPs can provide the following services to help DoD contractors become compliant:

• Security Assessment: Audit the DoD contractor’s current system against NIST SP 800-171
• System Security Plan: Develop a compliant System Security Plan (SSP) and Plan of Action and Milestones (POAM)
• Remediate: Implement items called out in the POAM
• Compliance Monitoring and Maintenance: Ongoing advanced cybersecurity monitoring and incident response capabilities are required to remain compliant.

For more information, please see our complete Guide to DFARS Compliance developed specifically for DoD Contractors.

Importance of Compliance for DoD Contractors

With the DoD factoring in cyber security into contract awards, it is very important for all DoD contractors to make security a priority. If a DoD audit finds that a contractor is not in compliance, the auditors can issue a stop-work order, which prevents the contractor from carrying out any work on behalf of DoD until they can prove they have put suitable security measures in place. In some extreme cases, the DoD can terminate contracts with contractors who have failed an audit and even bar them from working with the DoD in future.

DoD contractors who need help to comply with DFARS and pass a DoD audit can get in touch with a Managed Security Service Provider (MSSP) who specializes in DFARS/NIST SP 800-171 Compliance Solutions. A compliance consultation from SysArc is free and can help contractors find out whether they are doing enough to keep their Controlled Unclassified Information (CUI) safe.

The U.S. Department of Defense (DoD) has released final guidance on assessing contractor compliance with NIST SP 800-171 during the contract award process. Based on the guidance, this article focuses on what is required of DoD Contractors to prove compliance with DFARS in their pre-award solicitations and post-award contracts with the Department of Defense in accordance with NIST SP 800-171.

Proof of compliance relies heavily on the development and implementation of two documents: A Systems Security Plan (SSP) and a Plan-of-Action and Milestones (POA&M). Guidelines on how these two documents fit in the contract award process with the DoD can be found below.

Pre-Award Guidelines:

1. Admit Compliance: In accordance with DFARS 252.204-7008, the solicitation must include self-attestation of compliance with DFARS 252.204-7012 and implementation of NIST SP 800-171. The DoD interprets “self-attestation” as admission of compliance, and “implementation” of NIST SP 800-171 as having a completed Systems Security Plan (SSP) and a Plan-of-Action and Milestones (POA&M) in accordance with NIST SP 800-171. NIST provides templates for both SSPs and POA&Ms. For DoD prime and subcontractors who do not have the resources or expertise to develop and implement an SSP and POA&M, see our NIST Compliance Services.
2. Detail Enhanced Security Measures (if applicable): In accordance with DFARS 252.204-7008, should the requirements of the requiring activity deem it necessary for the contractor to implement enhance security measures in addition to NIST SP 800-171, the contract must include a Statement of Work (SOW) detailing the implementation of the additional security measures.
3. Support Evaluation Process: The Compliance Guidance reveals how the DoD will conduct the assessment of a contractor’s compliance status. The DoD’s evaluation process is based on four objectives:
• Establish ‘Go/No Go’ evaluation criteria threshold. The Contractors SSP and POA&M will be scrutinized against this criteria and an “acceptable” level of compliance will be established.
• Establish a separate technical evaluation factor, which would also require delivery of the SSP(s) and POA&M(s) with a more detailed description of how compliance would be judged in Section M.
• Conduct on-site assessments of the contractor’s internal information systems using NIST SP 800-171A.
  Identify Tier 1 suppliers and their plans for flowing down the requirements of the DFARS Cyber Rule and for assuring subcontractor compliance.

Post-Award Guidelines:

1. Deliver SSP and POA&M: The contractor must incorporate their Systems Security Plan (SSP) and POA&M in the contract. These two documents become a contractual requirement which means failure to comply with them could result in contract performance issues and/or breach of contract. Additionally, contractors must provide an SSP that meets the requirements of the Data Item Description (DID) which is included in the Compliance Guidance. While there is no prescribed format or specified level of detail for an SSP, NIST provides a template. They also provide a template for the development of a POA&M. For DoD prime and subcontractors who do not have the resources or expertise to develop and implement an SSP and POA&M, see our NIST Compliance Services for more information.
2. Support On-Site Assessments: The contractor must include a Statement of Work requiring the contractor to support an independent on-site government assessment of compliance of NIST SP 800-171 in accordance with NIST SP 800-171A by the Department of Defense.
3. Identify CDI including Tier 1 Suppliers: The Data Item Description (DID) included in the Compliance Guidance requires prime contractors to complete the following for every Tier 1 supplier:
• Provide basic identification information,
• Verify that it has flowed down the substance of DFARS 252.204-7012 to the supplier, as well as any additional security requirements;
• State whether the supplier has done a self-assessment in accordance with NIST SP 800-171A; and
  Provide a copy of the supplier’s SSP and POA&M.

Support and Consultation:

If you are a DoD Prime or Subcontractor and have questions about the DoD’s Compliance Guidance and how to develop the required SSP(s) and POA&M(s), a qualified Managed Security Services Provider who specializes in DFARS Compliance can help you meet compliance. As a DFARS/NIST SP 800-171 consultant who has provided compliance solutions for DoD contractors all over the United States, we’re happy to point you in the right direction. We’re available at 800-481-1984.