Department of Defense contractors and their subcontractors have until December 31 to obtain DFARS compliance

Third-party data breaches are a serious problem, especially when highly sensitive data is involved – and our nation’s infrastructure, including our defense systems, are built and maintained by third-party government contractors. Recognizing this, the U.S. Department of Defense is requiring that all of its contractors, as well as their subcontractors, comply with the security controls specified in NIST Special Publication 800-171r1, also known as DFARS (Defense Federal Acquisition Regulation Supplement). The deadline for DFARS compliance is December 31, 2017.

As expected, DFARS compliance mandates that DoD contractors and subcontractors adhere to rigorous protocols to protect sensitive data and promptly report cyber incidents. However, DFARS also goes a step further by additionally mandating the protection of “Unclassified Controlled Technical Information (UCTI).” UTCI is defined as “information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.”

This rather broad definition means that any organization that is handling DoD data, whether as a direct (prime) contractor or a subcontractor, must comply with DFARS.

Understanding DFARS Compliance

DFARS compliance was originally based on NIST Special Publication 800-53, which contains 18 control families and 303 requirements. However, after many contractors found the rules to be overly complex, NIST released Special Publication 800-171, which condensed the protocols down to 14 control families and 109 requirements. This was later updated to NIST Special Publication SP800-171r1.

While DoD contractors are accustomed to adhering to comprehensive security controls, since DFARS addresses the security of unclassified systems, many contractors will have to extend their controls to cover additional systems.

Noncompliance with DFARS is not an option for contractors and subcontractors who wish to continue working with the DoD after the December 31 deadline. There is no reason to believe that the DoD will extend this deadline and every reason to believe it will abruptly cut off any contractors who are not compliant. The agency recently held an Information Industry Day emphasizing the importance of DFARS compliance and reminding attendees of the approaching deadline.

In addition to enabling an organization to continue working on DoD contracts, there is inherent strategic value in DFARS compliance. Other public and private-sector organizations know how rigorous DFARS compliance standards are and recognize that service providers who are compliant are serious not only about their own cyber security but that of their own third-party vendors. It also demonstrates due diligence in the event of legal action or matters of business insurability.

Is your organization ready to meet the December 31 deadline? DFARS compliance is complex, and time is running out, which is why it’s best to enlist the help of a professional IT audit and cyber security firm such as Continuum GRC. We create sustainable DFARS and NIST 800-171 based compliance partnerships with our clients. Our proven methodology and project plan, powered by our proprietary IT Audit Machine IRM IRM GRC software solution, will help you achieve compliance on budget and on schedule.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

Schedule some time with our Superheroes for a Free Assessment!