Revised DFARS Interim Rule Regarding Cybersecurity Responds to Industry Concerns
After collecting feedback from industry representatives, the Department of Defense ("DOD") recently revised the Defense Federal Acquisition Regulations Supplement ("DFARS") interim rule on required cybersecurity measures for defense contractors (the "December 30 Interim Rule"). As published in August 2015, the revised DFARS clause 252.204-7012 required contractors to provide "Adequate Security" for Covered Defense Information ("CDI") by implementing the security requirements of the National Institute of Standards and Technology ("NIST") Special Publication ("SP") 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations." We discussed the August interim rule and related government requirements in depth in our earlier Commentary, including practical issues contractors face in implementation. After publishing that rule, the DOD issued a class deviation allowing contractors up to nine months for implementation of security requirements. The December 30 Interim Rule gives contractors additional time to implement the requirements of NIST SP 800-171 and incorporates a number of changes that will affect contractors' cybersecurity compliance policies.
Implementation Period
The revised interim rule phases in the requirement to comply with NIST SP 800-171 over the next two years. The revised rule requires implementation of NIST SP 800-171 by December 31, 2017. Along with this enlargement of implementation time, however, the revisions require contractors to notify the DOD of any security requirements that are not implemented at the time of the contract award. This notification, which must be made within 30 days of the contract award, is intended to assist the DOD in monitoring progress and identifying trends in the implementation of the requirements across the defense industrial base, including identification of specific requirements that may require clarification or adjustment.
Approval of Alternative But Equally Effective Security Measures
The August 2015 interim rule provided that contractors could implement alternative but equally effective security measures in lieu of compliance with the NIST SP 800-171. Utilization of such alternative measures required notice to and acceptance by the DOD prior to the award of the contract. The December 30 Interim Rule provides for two procedures applicable to alternative measures. First, a contractor must identify any alternative measures that deviate from NIST SP 800-171 as part of its non-implementation notice given within 30 days of contract award pursuant to DFARS 252.204-7012, as described above. These alternative measures do not appear to require pre-award approval. If a contractor plans to deviate from NIST SP 800-171 on a permanent basis, however, it must, pursuant to DFARS 252.204-7008, submit its plan and justification to the DOD for pre-award adjudication by the DOD Chief Information Officer.
Scope of Flow Down
The revised rule also tailored the flow-down requirements for DFARS clause 252.204-7012. Under the revisions, contractors are required to flow down only to those subcontractors and suppliers where the subcontractors' or suppliers' efforts will include CDI or operationally critical support. Although this provides some common sense relief to contractors, given the broad scope of information requiring protection as CDI, the practical effect may be marginal for all but the most routine acquisitions of commercial items or services.
Flow Down Without Alteration
The August 2015 interim rule mandated flow down of DFARS clause 252.204-7012 and the related DFARS clause 252.204-7009, "Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information." The December 30 Interim Rule clarifies that these flow downs must be made without alteration, except to identify the parties.
The DOD's response to industry's concerns about the August 2015 iteration of the cybersecurity rule is a welcome development. Defense contractors should continue to work with the DOD regarding these new requirements to address practical issues and complications as they arise.
Lawyer Contacts
For further information, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com/contactus/.
Peter F. Garvin III
Washington
+1.202.879.5436
pgarvin@jonesday.com
J. Andrew Jackson
Washington
+1.202.879.5575
ajackson@jonesday.com
Fernand A. Lavallee
Washington
+1.202.879.3486
flavallee@jonesday.com
Todd S. McClelland
Atlanta
+1.404.581.8326
tmcclelland@jonesday.com
Mauricio F. Paez
New York
+1.212.326.7889
mfpaez@jonesday.com
Jeff Rabkin
San Francisco
+1.415.875.5850
jrabkin@jonesday.com
Grant H. Willis
Washington
+1.202.879.3847
ghwillis@jonesday.com
D. Grayson Yeargin
Washington
+1.202.879.3634
gyeargin@jonesday.com
Jay Johnson
Dallas
+1.214.969.3788
jjohnson@jonesday.com
Chad O. Dorr
Washington
+1.202.879.3795
cdorr@jonesday.com
Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.
