October 20, 2018

October 19, 2018

Subscribe to Latest Legal News and Analysis

October 18, 2018

Subscribe to Latest Legal News and Analysis

DoD Updates Internal Guidance on DFARS Cyber Rule

The Department of Defense (“DoD”) has updated portions of its internal guidance addressing compliance with the requirements of Defense Federal Acquisition Regulation Supplement (“DFARS”) 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.”

In particular, on December 1, 2017, the office of Defense Procurement and Acquisition Policy updated its Procedures, Guidance and Information (“PGI”) with regard to DFARS 252.204-7012.  The PGI contains both mandatory and non-mandatory internal DoD procedures, guidance, and supplemental information.  Although the PGI is internal to DoD, it provides contractors with insight into how DoD interprets its own regulations.  Notable changes to the guidance include the following:

  • Clarifies that the requiring activity’s obligation to notify the Contracting Officer (“CO”) when covered defense information (“CDI”) or operationally critical support is expected in contract performance extends to individual task and delivery orders.

  • Directs the requiring activity to create a “work statement or specification that includes the identification of covered defense information or operationally critical support.”  This section is consistent with DoD statements to industry in the past year that procuring entities are responsible for notifying contractors when contract performance involves CDI.

  • Explicitly requires the CO to ensure that both the solicitation and resultant contract, task order and/or delivery order “includes the requirement (such as a contract data requirements list), as provided by the requiring activity, for the contractor to apply markings, when appropriate, on covered defense information.”

  • Removes statements that (i) the safeguarding requirements apply until such time as the requiring activity removes or changes the designation, and (ii) the CO must coordinate with the requiring activity about disposition of CDI associated with a contract.

  • Restates that in cyber incidents involving multiple contracts, DoD is responsible for designating one point of contact to coordinate “additional actions required of the contractor, on behalf of affected DoD components.”  This is consistent with the appointment of a Damage Assessment Management Office (“DAMO”) currently contemplated by current DoD guidance, but this updated PGI explicitly states that the affected contractor should receive direction from only one CO on behalf of all affected DoD components.

  • Specifies that once the damage assessment is complete, the requiring activity must provide the CO with a report that documents “actions taken to close out the cyber incident.”  Previously, the guidance required the requiring activity to provide the CO with a “report documenting the findings from the damage assessment activities affecting covered defense information,” with a copy to the contractor.  As revised, the requirement to provide a copy of the report to the contactor has been eliminated.

These updates are consistent with DoD’s attempts to clarify the interpretation of DFARS 252.204-7012 ahead of the implementation deadline of December 31, 2017.  Expected next are revised Frequently Asked Questions that will incorporate some of the learning from DoD’s June 23, 2017 Industry Day on this clause. 

© 2018 Covington & Burling LLP


About this Author

Susan B. Cassidy, Government Contracts Attorney, Covington Burling, Law Firm

Susan Cassidy advises clients on the complex rules and regulations imposed on government contractors, with a special emphasis on the defense and intelligence sectors. She combines a sophisticated knowledge of the FAR and DFARS with the practical insight gained from senior in-house positions at both dedicated defense and commercial item contractors.

Ms. Cassidy conducts internal investigations for clients on wide array of government contracts and national security compliance issues. She regularly advises on FAR mandatory disclosure obligations and represents...

Evan Sherwood, Covington Burling Law Firm, Government Contracts Attorney

Mr. Sherwood helps clients solve problems arising from government contracts. He advises government contractors on a wide range of matters, such as compliance with procurement regulations, contract formation, and government investigations. Mr. Sherwood also represents clients in bringing and defending bid protests, including challenges to the terms of competitions.

Representative Matters

  • Successfully protested award of multiple civilian IDIQ contracts.
  • Advised contractor on responding to a solicitation for therapeutics issued by the Department of Health and Human Services.
  • Counseled life sciences contractor on drafting government subcontracts.
  • Successfully defended protest challenging award of a Navy task order.
  • Represented client during agency inquiry regarding organizational conflict of interest, resulting in favorable outcome.