Blog

Posts Tagged Defense

Recent development in the DOD cybersecurity regulations

Share

An update to our December post on implementation of a NIST SP 800-171r: This past Tuesday (April 24th 2018), DOD issued draft regulations on its cybersecurity clause DFARS 252.204-7012.  Attached are pdf copies of the Federal Register notice plus the two documents referenced in the notice.

PTAP has been advised that DOD has implicitly acknowledged that contractor implementation of a NIST SP 800-171r cybersecurity plan is not going as anticipated.  The draft guidance explains three levels of priority within an implemented System Security Plan (“SSP”). The utility of the priority levels is that DOD has identified the priorities on an item-by-item basis per the NIST security requirement.  For example, multifactor authentication (NIST 171, 3.5.3) is a priority 1 (“P1”) while monitoring security controls (NISAT 171, 3.12.3) on an ongoing basis is a priority 3 (“P3”).  DOD is again focusing on the development of SSP as supplemented by a Plan of Action that includes an implementation schedule.

More importantly, and as highlighted during the presentations sponsored by PTAP, DOD has emphasized that SSPs (with or without an accompanying Plan of Action) will be an evaluation factor used to discriminate among offers as a means to evaluate the government’s overall risk of providing “covered Defense information” to contractors who then use or store CDI on their IT systems.  Specifically, the draft guidance states that RFP’s must require delivery of NIST SP 800-171 Security Requirement 3.12.4 – System Security Plan (or specified elements of) and [NIST-171] Security Requirement 3.12.2 – Plans of Action with the contractor’s technical proposal.

Thanks to David B. Dempsey of Dempsey Fontana, PLC of making us aware of these recent developments!

Posted in: Uncategorized

Leave a Comment (0) →

Dept. of Navy Rapid Innovation Fund (RIF) program update

Share

***********************************************

January 2018 update on the Dept. of Navy Rapid Innovation Fund (RIF) program:  Good news especially for small, innovative companies who want to perform final development and testing and sell the resulting product to the DOD:  Section 213 of the FY17 NDAA removed the RIF program sunset clause, providing permanent authority for the program.  While the FY18 defense appropriation is still pending, and a RIF plus up is necessary, OSD is gearing up for an FY18 RIF BAA in the Feb/March 2018 timeframe, which will include topics from all the defense services.  Typical service-wide RIF funding available is $200-250M.  The full BAA schedule and latest info is at http://www.defenseinnovationmarketplace.mil/rif.html.

 

Government TPOCs can talk openly now; communications become restricted upon BAA release.  Historically, about 2/3 of Dept. of Navy RIF awards go to fund projects which derive from the SBIR program.  It’s easy to apply for RIF (three page white paper + quad chart), but the competition is quite fierce (~4% of white papers result in a full proposal invite).  Interested companies may want to review the FY17 BAA-Amendment 2 (Dept. of Navy topics on pages 45-69) now as many of the topics represent persistent Dept. of Navy needs.  This National Defense Magazine article provides sound advice.

***********************************************

Brenda Pickett
Director, Office of Small Business Programs
Office of Naval Research
875 North Randolph St.
ONR Code: 00SB
Attention: Brenda Pickett
Arlington, VA 22203-1995
Tele: 703-696-2607
Email: brenda.pickett@navy.mil

Posted in: Press Releases

Leave a Comment (0) →

NIST and DFARS and Cyber Compliance! (oh my)

Share

You have doubtless heard and read all about the looming requirement for all Department of Defense government contractors to become compliant with Defense Federal Acquisition Regulation Supplement (DFARS) minimum security standards derived from NIST SP 800-171 Rev 1 by Dec 31, 2017- or else risk losing their contracts.  DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, will be a mandatory clause in all contracts except for contracts solely for the acquisition of COTS items.

This requirement applies to any DoD Contractor, subcontractor, and supplier ALL THE WAY DOWN THE SUPPLY CHAIN that processes, stores, or transmits Controlled Unclassified Information (CUI). Not just security contractors. Not just companies that have clearances. Not even just IT contractors.  If you have a landscaping business and you are performing work at a DOD facility, and have access to blueprints that are or may be considered CUI, you’re subject to this requirement.  CUI includes the categories outlined in the NARA CUI Registry, but as you can probably imagine, is not limited to that. your government customer can identify additional categories and data, and you as a contractor, should err on the safe side and identify potential CUI so that you can protect and segregate it just in case.

Note: civilian contractors are not subject to this requirement (there are only 15 security controls outlined in FAR part 52.204-21 compared to 109 in the DFARS clause), but that may be changing to synthesize the compliance requirements to the more complete set that the DOD/DFARS adopted.

Ultimately, it is the contractor’s responsibility to determine whether it is has implemented the NIST SP 800-171 (as well as any other security measures necessary to provide adequate security for covered defense information).   Third party assessments or certifications of compliance are not required, authorized, or recognized by DoD, nor will DoD certify that a contractor is compliant with the NIST SP 800-171 security requirements.

The protections required to protect government information are dependent on the information DoD is protecting and the kind of system on which the information is processed or stored.

There is no single or prescribed manner in which a contractor may choose to implement the requirements of NIST SP 800-171, or to assess their own compliance with those requirements.  For companies new to the requirements, a reasonable first step may be for company personnel with knowledge of their information systems security practices to read through the publication, examining each requirement to determine if it may require a change to company policy or processes, a configuration change for existing company information technology (IT), or if it requires an additional software or hardware solution.

Some resources and tools to help you determine whether you’re subject to the requirement, and what you can do next:

  1. DOD Office of Small Business Cyber resources and news – especially the 49-minute video and the presentation slides
  2. DOD Procurement Toolbox – Cyber security section (including how to approach evaluating each requirement)
  3. Georgia Tech PTAC 20-min Instructional Video
  4. A handy presentation [from a law firm] that translates the major requirements into easy-to-understand terms
  5. The Safeguarding Covered Defense Information one-pager to ease you into the basics.
  6. The Cybersecurity Evaluation Tool (CSET) that provides a systematic approach for evaluating an organization’s security posture through a step-by-step process to evaluate their control system and information technology network security practices.  The tool will allow you to select a standard (e.g. NIST SP 800-171) – and CSET will generate specific questions to those requirements and present you with assessment results.
  7. A  Self-assessment guide when you’re ready for the deep dive
  8. OSD Memorandum: DPAP Guidance for DoD Acquisition Personnel that instructs DOD buyers how to implement and evaluate vendor cyber compliance (and since it’s going to be an evaluation factor in source selection, you need to know what your customers expect).
  9. For subcontractor and supplier reference – Lockheed Martin’s notice to its supply chain that you may find informative and applicable regardless of who your prime is.
  10. And if you heard the rumors of possible delay and were wondering if they have merit — sadly, no.

PTAP counselors can help you walk through these steps. While we’re not technical experts on network security, we could help you walk through the self-assessment and determine what steps you need to take to bring your business up to compliance.

Update: This past Tuesday (April 24th 2018), DOD issued draft regulations on its cybersecurity clause DFARS 252.204-7012.  Attached are pdf copies of the Federal Register notice plus the two documents referenced in the notice.

PTAP has been advised that DOD has implicitly acknowledged that contractor implementation of a NIST SP 800-171r cybersecurity plan is not going as anticipated.  The draft guidance explains three levels of priority within an implemented System Security Plan (“SSP”). The utility of the priority levels is that DOD has identified the priorities on an item-by-item basis per the NIST security requirement.  For example, multifactor authentication (NIST 171, 3.5.3) is a priority 1 (“P1”) while monitoring security controls (NISAT 171, 3.12.3) on an ongoing basis is a priority 3 (“P3”).  DOD is again focusing on the development of SSP as supplemented by a Plan of Action that includes an implementation schedule.

More importantly, and as highlighted during the presentations sponsored by PTAP, DOD has emphasized that SSPs (with or without an accompanying Plan of Action) will be an evaluation factor used to discriminate among offers as a means to evaluate the government’s overall risk of providing “covered Defense information” to contractors who then use or store CDI on their IT systems.  Specifically, the draft guidance states that RFP’s must require delivery of NIST SP 800-171 Security Requirement 3.12.4 – System Security Plan (or specified elements of) and [NIST-171] Security Requirement 3.12.2 – Plans of Action with the contractor’s technical proposal.

Posted in: Uncategorized

Leave a Comment (0) →

Department of Defense Waiving SAM registration requirements for emergency response vendors

Share

Due to the emergency situation caused by the hurricanes, contracting offices are using authority to waive the requirement for SAM registration in purchases that directly support the emergency response.  If you’re helping a vendor who is not yet registered in SAM but needs a CAGE code, the expedited process instructions are below. 

(information on selling to disaster response agencies)

Subject: Obtaining CAGE codes for vendors responding to the Hurricanes

Hello everyone – obviously we expect that there will be many offices responding to the hurricanes with emergency purchases where SAM registration is waived per FAR 4.1102(a)(3)(iii) and part 18.102.  We want to get the below instructions out for how you can still help your vendors obtain CAGE codes (if they don’t already have one) that are required per FAR 4.1804 for other than micro-purchase actions:

1 – Go to https://cage.dla.mil

2 – Choose ‘Request or Update a CAGE Code’ and hit Begin on the next page

The user will then be taken through a series of pages where they provide the data necessary to set up a CAGE code, but before they get to those elements, they have to answer a few more questions.  In order for the CAGE website not to just direct them to go register in SAM, the users need to answer exactly as follows:

  1. Question – Do you have a registration for this same entity in process at System for Award Management (SAM)?  Answer – No
  2. Question – Do you plan to receive contract payments or grants from the U.S. Government?  Answer – No
  3. Question – Are you a NON-U.S. entity (government or commercial)?  Answer  No (note – if the entity really is foreign, answer Yes, but realize that the user will be directed to contact his/her home country codification bureau)
  4. Question – Are you requesting a new CAGE Code?  Answer – Yes
  5. Question – Do you have a previous business?  Answer – No
  6. Question – Please choose your Entity Type   Answer either – (1) U.S Commercial Company/Firm, Organization or Government Entity (non-federal) OR (2) Sole Proprietor Business
  7. Question – Please choose a Primary Purpose for this CAGE   Answer -Other
  8. Question – Please describe the primary purpose for this CAGE  Answer – Provide Urgent Hurricane Irma Support (or Harvey or Jose as appropriate)

From here on, the user is just providing their name, address, etc.information.  Should be simple from here.

Be aware – when a user requests a CAGE code be established via this method (instead of through registering in SAM), it goes into manual processing at DLA in Battle Creek.  It’s very important that the user enter ‘hurricane’ in the purpose field after they choose other.  The CAGE team is going to search for that term in each request that comes in and move those to the top to be worked.

For non-GPC actions, it’s important that the vendor get a CAGE code assigned and it be included in the contract when its distributed to ensure that their eventual payment is streamlined and not held up for manual action.  Note also that without a valid CAGE code, an action will fail Procurement Data Standard (PDS) validations.

If these are going to be on-going contracts (such as reconstruction), it would behoove the vendors to eventually actually get registered in SAM (they can use the CAGE code that will be assigned in this process when they do so) even if they’re not technically required to do so because the contract was initially exempted due to the emergency.  Being registered in SAM will just make the whole invoicing and payment processes run a bit smoother if the contract lasts for a while.

Lisa Romney, Defense Procurement and Acquisition Policy Office of Acquisition Technology and Logistics

 

Posted in: Resources

Leave a Comment (0) →

Navy signs MOU with GSA

Share

GSA and Department of the Navy recently signed a memorandum of understanding for extended use of the OASIS (One Acquisition Solution For Integrated Services) contract for complex professional services requirements. Its focus includes, but is not limited to; Military Engineering, Aircraft R&D, and Space and Missiles R&D. Using the OASIS contract offers the NAVY a streamlined acquisition tool to meet its requirements while reducing costly duplicate contracts. Additional information: OASIS@GSA.GOV.

Posted in: Resources

Leave a Comment (0) →

Procurement Instrument Identifiers (PIID) structure changes

Share

Source: Defense Logistics Agency

In order to standardize procurement transactions across the Federal Government, the Federal Acquisition Regulation (FAR) Subpart 4.16, Unique Procurement Instrument Identifiers (PIID) has been amended to implement a uniform award identification system referred to as the Procurement Instrument Identification (PIID).

For DLA, the new PIID structure will continue to require use of Activity Address Codes (AACs) as the unique identifier for contracting offices, the current fiscal year, instrument type and a four-character serial number.   Existing contract, purchase order, and delivery order numbers will not change.

Beginning October 1, 2016:

  • Manual purchase order numbers will change from “M” to “P” in the 9th position.  Automated purchase orders will continue to use a “V” in the 9th position.

Beginning October 2017:

  • Task/Delivery Order numbers will be issued with a unique 13-character delivery order number as described above, containing “F” or “M” in the 9th position; the current four-character supplementary call number identifier will no longer be utilized.
  • A “M” in the ninth position of the PIID will identify purchase orders and task or delivery orders issued by the enterprise FedMall system.
  • All modifications, including modifications to calls and task/delivery orders, will utilize a 6-character format, added to the 13-character PIID being modified.

More information about the October 2017 changes will be provided as we move closer to the implementation date.

Please monitor the DLA Internet Bid Board System (DIBBS) and/or the Supplier Information Resource Center (SIRC) for updates.  Additional information will be provided as we move closer to the implementation dates.

Posted in: Resources

Leave a Comment (0) →