Safeguarding Covered Defense Information CYBER SECURITY Safeguarding Covered Defense Information March 2017

Goal Improve DLA’s business relationships with vendor base to better accomplish our shared mission of supporting warfighters worldwide by mitigating risk and reducing vulnerability to cybercrime

Who is Impacted DFARS 252.204-7012 applies to all DOD solicitations and contracts for commercial items Exception: solicitations and contracts solely for the acquisition of Commercial Off the Shelf (COTS) items Requires flow down to: Suppliers at all tiers including Commercial suppliers Subcontractors at all tiers

How? Provide updates to contractors for cybersecurity requirements Define what is “Covered Defense Information” Where and how to apply “Adequate Security” Cyber incident reporting requirements

Covered Defense Information (CDI) Defined as: Unclassified controlled technical information; or Information, as described in the Controlled Unclassified Information (CUI) Registry at: http://www.archives.gov/cui/registry/category-list.html Requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government wide policies, AND IS: Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract

Covered Defense Information (CDI) CDI Definition Continued… DLA L&M will apply DFARS 252.204-7012 requirement for safeguarding CDI as follows: National Stock Number (NSN) has demilitarization code other than A; or Technical Data Package contains document(s) with distribution statement other than A; or Identification of export control; or Information contained in the customer and/or applicable agency specific critical information list For DLA L&M, if CDI is included in the technical data package for an acquisition it will be specifically identified in the Purchase Item Description (PID) Note: CDI may also be contained in contractor-owned data and is identified with a similar contractor type coding as described above

CDI: Controlled Technical Information Defined as: Technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24 Distribution Statements on Technical Documents The term does not include information that is lawfully publicly available without restrictions

Controlled Technical Information L&M Distribution Statements B-F Reasons for assignment of distribution statements B-F in L&M technical documents: Critical Technology Export Controlled Foreign Government Information Operations Security Premature Dissemination Proprietary Information Test and Evaluation Software Documentation Vulnerability Information Contractor Performance Evaluation Administrative or Operational Use Reference DoDI 5230.24: http://www.dtic.mil/whs/directives/corres/pdf/523024p.pdf See pages 14-21 of the DoDI 5230.24 for additional details

CTI: Controlled Technical Information Unclassified information not limited to: Design & Manufacturing Technical Data Keystone Equipment Inspection and Test Equipment Or data related to a specific military deficiency of a potential adversary

CTI: Export Control Unclassified information concerning: Certain items Commodities Technology Software Or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives.

CTI: Test & Evaluation Information related to: Protect Results of Test/Evaluation of Commercial Products or Military Hardware Occurs when disclosure may cause unfair advantage or disadvantage to the manufacturer of the products

Applying “Adequate Security” Information Sharing/Collaboration Toolbox Only to information systems containing CDI Implement security protections on: IT operated on behalf of Government Not part of IT operated on behalf of Government On contractors assessed risk or vulnerability

IT Not Operated on Behalf of DoD National Institute of Standards and Technology (NIST) NIST SP 800-171 Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations Isolate CUI into own security domain Limit scope to CUI particular system or components Don’t try to boil the ocean

NIST SP 800-171 Basic Security Basic Security Requirements Access Control Physical Protection Awareness and Training Risk Assessment Audit and Accountability Security Assessment Configuration Management System and Communication Protection Identification and Authentication System and Information Integrity Incident Response Maintenance

Implementation of NIST SP 800-171 Implement NIST SP 800-171, as soon as practical, but NTL December 31, 2017 Contracts awarded prior to October 1, 2017, the Contractor shall notify the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, and the contracting officer within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award

Request to Varying from NIST SP 800-171 Contractors electing to vary/deviate from the NIST SP 800-171 requirement must submit their requests in writing to the Contracting Officer of record The Contracting Officer will then submit the request on behalf of the contractor to the DoD CIO for consideration Contractor do not need to implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under the contract

Cyber Incident Reporting Requirements Contractor discovers a cyber incident affecting: Contractor information system Covered Defense Information Required elements of cyber incident report DoD-approved medium assurance certificate For information on obtaining a DoD-approved medium assurance certificate, see: http://iase.disa.mil/pki/eca/Pages/index.aspx

When you have a Cyber Incident Conduct a review for evidence of compromise of CDI Including, but not limited to: Compromised Computers Compromised Servers Specific Data User Accounts Covered contractor information systems Rapidly report to http://dibnet.dod.mil

What goes in Cyber Incident Report Include elements required by http://dibnet.dod.mil

Within 72 Hours Within 72 hours report as much of the following: Company name Ability to provide operationally critical support Company Point of Contact (POC) Date incident discovered Data Universal Numbering System (DUNS) Number Location(s) of compromise Contract number(s) or other type of agreement affected Incident location CAGE code DoD programs, platforms or systems involved Contracting Officer or other agreement POC Type of compromise USG Program Manager POC Description of technique or method used in incident Contract or other agreement clearance level Incident outcome Facility CAGE code Incident/Compromise narrative Facility Clearance Level Any additional information Impact to CDI

Questions/Resources For additional information on the cyber security requirement please see the following resources: FAQs: http://www.acq.osd.mil/dpap/pdi/docs/FAQs_Network_Penetration_Reporting_and_Contracting_for_Cloud_Services_(01-27-2017).pdf. DoDI 5230.24: http://www.dtic.mil/whs/directives/corres/pdf/523024p.pdf CUI Registry: http://www.archives.gov/cui/registry/category-list.html Medium Assurance Certificate: http://iase.disa.mil/pki/eca/Pages/index.aspx Cyber Incident Report: http://dibnet.dod.mil DOD CIO: osd.dibcsia@mail.mil DFARS Clause 252.204-7012: http://farsite.hill.af.mil/vfdfara.htm DFARS PGI 204.73: http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/PGI204_73.htm#204.7303-3