Virtually All Federal Contractors Now Subject to “Basic Safeguarding” Cybersecurity Requirements

Under a joint Department of Defense (DoD), NASA, and General Services Administration (GSA) rule issued today, virtually all future federal contracts will likely require contractors to implement a set of cybersecurity measures to attain the “basic safeguarding” of contractor systems that process, store, or transmit a newly defined category of “federal contract information.”¹ The result is that many IT systems owned or controlled by federal contractors will need to be compliant with the rule’s set of required safeguards.  This rule comes nearly four years since a proposed rule on the subject was first issued (on August 24, 2012).

The rule expressly lists a set of fifteen security controls that most contractors will be expected to implement if their systems are likely to process, store, or transmit a broadly defined category of “Federal contract information.”  That category of information (defined fully below) includes most information provided by the government to contractors or generated for the government in the course of performing the contract.  Controls mandated by the rule for covered contractor systems include limiting information system access to the types of transactions and functions that authorized users are permitted to execute; monitoring, controlling, and protecting organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems; and even physical security controls like escorting visitors and monitoring visitor activity and maintaining audit logs of physical access.

All told, while it requires concerted focus on compliance, the rule is likely to be taken as more limited and palatable to defense contractors than the DoD’s now 10-month-old DFARS rule, which was first implemented last August to address “enhanced safeguarding for certain sensitive DOD information” on contractor systems.²  In fact, in comparison to the DFARS, it may be more illustrative to describe what the rule does not do:

The rule does not include any mandatory cyber-incident reporting requirements or other elements or provisions related to cyber incident response, analysis, or data collection. 

The rule also does not require federal contractors governed only by this cybersecurity rule (as opposed to the DFARS rule) to provide DoD with access to additional information or equipment necessary to conduct a forensic analysis in the event of a cyber incident.

Both of  these elements of the recent DFARS rule on safeguarding covered defense information have proven to be some of the most troubling for defense contractors.³ Furthermore,

The rule does not require federal contractors to meet the full set of controls from NIST Special Publication (SP) 800-171, the standard governing most systems covered by the DFARS rule.  

The rule does not specifically address cloud computing or prescribe any controls or requirements that directly address the use of cloud solutions.

Also unlike the DFARS rule,⁴ this new FAR clause is not mandated for commercial off the shelf (COTS) acquisitions (though it is mandatory for other commercial items under Part 12).

However, the Federal Register announcement of the rule states that the rule is only “intended to provide a basic set of protections for all Federal contract information” and that “other rules” that will build on this rule are forthcoming, such as a rule to protect controlled unclassified information (CUI) including personally identifiable information.⁵ In fact, the Federal Register  notice indicates that DoD, NASA, and GSA “plan to develop regulatory changes for the FAR in coordination with National Archives and Records Administration (NARA) which is separately finalizing a rule to implement E.O. 13556 addressing CUI.”⁶

The agencies assert that “[a]ll of these actions should help, among other things, clarify the application of the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST) information systems requirements to contractors and, by doing so, help to create greater consistency, where appropriate, in safeguarding practices across agencies.”⁷

Covered Contractor Systems

Most federal contractor information systems are likely to be covered by this new FAR clause.  The FAR now requires that the new clause (FAR part 52.204-21), be inserted into contracts, “including acquisitions of commercial items other than commercially available off-the-shelf items . . . when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system.”⁸ Notably, the “may have” language in this implementing provision of the FAR suggests that many contracts will contain the clause, even if there is only a possibility that a contractor will process, store, or transmit “Federal contract information[.]”

That being said, Federal contract information is a newly defined term that is rather broad.  It is defined to mean “information, not intended for public release, that is[:]”

provided by or generated for the Government

under a contract

to develop or deliver a product or service to the Government[.]⁹

However, the term does not include “information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.”¹⁰ In turn, a covered contractor information system is “an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.”¹¹ Given how broadly the definition of “federal contract information” could be interpreted, it is likely that most federal contractors will own or operate at least some “covered contractor information systems.”¹²

The clause will also cover many subcontracts at any tier, as the clause itself requires contractors to flow down the clause (including the flowdown requirement itself), “in subcontracts under [the] contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.”¹³

“Safeguarding” Requirements and Procedures

Substantively, the clause requires that the contractor or subcontractor apply, at a minimum, the following security controls on covered systems to satisfy the requirement that the contractor provide a basic level of “safeguarding” of federal contract information:

1. 1. Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
2. 2. Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
3. 3. Verify and control/limit connections to and use of external information systems.
4. 4. Control information posted or processed on publicly accessible information systems.
5. 5. Identify information system users, processes acting on behalf of users, or devices.
6. 6. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
7. 7. Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
8. 8. Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
9. 9. Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
10. 10. Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
11. 11. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
12. 12. Identify, report, and correct information and information system flaws in a timely manner.
13. 13. Provide protection from malicious code at appropriate locations within organizational information systems.
14. 14. Update malicious code protection mechanisms when new releases are available.
15. 15. Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.¹⁴

Notably, although the Federal Register notice indicates that these controls were derived from NIST SP 800-171,¹⁵ the rule does not require that contractors turn to the NIST SP, nor any other particular resource or set of descriptive or prescriptive controls to satisfy the rule.  The agencies reiterate that the rule requires “only the most basic level of safeguarding” and suggest that “[a] prudent business person would employ this most basic level of safeguarding, even if not covered by this rule.”¹⁶ Because the rule includes an express set of controls, rather than relying on a separate standard like NIST SP 800-171 as the basis for the requirements, amendments to augment the required controls are likely over time.

Conclusion

While the new rule appears to be merely one small step in terms of the cybersecurity requirements imposed on federal contractors, the rule is one giant leap in that federal contractors are no longer left to their own devices to determine what cybersecurity controls are minimally required to adequately protect federal contract information. It is likely that this rule is the first in a long term series of mandates by the government regulating the safeguarding of federal contractor information systems.