Cybersecurity

Regulatory References

Federal Acquisition Regulation (FAR):

FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems

This clause is applicable to all solicitations and contracts when a contractor or subcontractor at any tier may have federal contract information residing in or transiting through its information systems, including commercial items other than commercially available off-the-shelf items (COTS).

Click here for CMMC Information

Synopsis

  • Requires basic safeguarding requirements and procedures to protect covered contractor information systems.
  • Imposes 15 categories of security controls focused on safeguarding contractor systems that process, store or transmit Federal contract information.
  • Although not specifically stated, contractors in compliance with the more expansive NIST SP 800-171 security controls will presumably be in compliance with the FAR requirements.
  • Applicable to all solicitations and contracts when a contractor or subcontract at any tier may have federal contract information residing in or transiting through its information systems. Does not apply to contracts or subcontracts for COTS.

252.204-7008 Compliance with Safeguarding Covered Defense Information (Oct 2016)

All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items

252.204-7009 Limitation on the Use or Disclosure of Third Party Contractor Reported Cyber Incident Information (Oct 2016)

All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, for services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (Oct 2016)

All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, except for solicitations and contracts solely for the acquisition of COTS items

252.239-7009 Representation of Use of Cloud Computing (Sept 2015)

All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial item, for information technology services

252.239-7010 Cloud Computing Services (Oct 2016)

All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial item, for information technology services

NIST SP 800-171 Security Requirements for Protecting Controlled Unclassified Information (CUI)

NIST SP 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal information systems and organizations. Generally, Department of Defense contractors, except COTS suppliers, are required to implement these security requirements

252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements.

All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, except for solicitations and contracts solely for the acquisition of COTS items

252.204-7020 NIST SP 800-171 DoD Assessment Requirements.

Suppliers must submit cyber self-assessment into the Supplier Performance Risk System (SPRS) against NIST 800-171

252.204-7021 Cybersecurity Maturity Model Certification Requirement.

For all solicitations with DFARS clause on CMMC, contractors must be certified at the required CMMC level at time of award.

Reporting a Cybersecurity Incident

In accordance with DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting, subcontractors, including vendors and consultants, are required to rapidly report cyber incidents within 72 hours of discovery directly to Department of Defense (DoD) at https://dibnet.dod.mil/portal/intranet/ . This includes providing the incident report number, automatically assigned by DoD and to General Dynamics Land Systems as soon as practical.

In addition, please notify your GDLS Buyer and the GDLS Security team at gdlssoc@gdls.com or 586-825-8646. Please include a detailed report of the incident including the following, as able:

  • Date and Time of when the Event took place
  • Summary on the Event and how it was detected
  • Detectors name, email, and phone number
  • Scope (Functional Impact, Informational Impact, and Recoverability Impact) of the Incident
  • Severity of the Incident
  • Method of detection

Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171 DoD Assessment Requirements

Overview

CMMC is a DoD certification process to measure a company’s ability to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC combines cybersecurity standards and maps these best practices and processes to maturity levels, from basic cyber hygiene to advanced/progressive.

All DoD contractors and subcontractors with access to FCI or CUI will have their cyber acumen scored on a scale of 1 to 5. The Department of Defense will use the same scale to stipulate in solicitations the CMMC level required.

Companies that solely produce Commercial-Off-The-Shelf (COTS) products do not require a CMMC certification.

A CMMC Accreditation Body -- a neutral third party that will maintain the standard for DoD –- was established to train and verify third-party cybersecurity certifiers who will conduct audits. Additional information regarding the CMMC Accreditation Body is available at https://www.cmmcab.org/.

All contractors and subcontractors with access to FCI or CUI must have a current DoD Assessment score in the DoD Supplier Performance Risk System (SPRS) for all CAGE codes covered by your System Security Plan (SSP). Refer to COMPLIANCE WITH DFARS 252.204-7020 NIST SP 800-171 DoD ASSESSMENT REQUIREMENTS for additional information.

Additional information regarding DoD’s CMMC is available at:

Department of Defense CMMC Information.

Supplier Impact

Certification of cybersecurity compliance will be required for suppliers to do business with General Dynamics Land Systems and the U.S. DoD, unless the supplier solely provides COTS. Certification of cybersecurity compliance is led by the Office of Under Secretary of Defense for Acquisition and Sustainment, and CMMC scores will be tracked by the DoD. Again, all companies will require a CMMC rating from 1 to 5 (except COTS suppliers), and DoD solicitations may restrict the use of suppliers below a specified CMMC level. In order for a supplier to process, store or transmit CUI, it must be certified at least at CMMC level 3.

Suppliers will be responsible for sourcing, conducting and reporting their CMMC audits via accredited third-party entities.

The CMMC Accreditation Body is developing the process for certifications. Refer to the “Organizations Seeking Certification” section of the CMMC Accreditation Body site for additional information: https://www.cmmcab.org/contractors.

Defense Information Systems Agency (DISA):