Upload File

dod cybersecurity rules: government contractors need to kno · nist sp 800-171 ‘tailoring...

  • Home
  • Documents
  • DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors
27
1 government contracting DoD Cybersecurity Rules: Government Contractors Need to Know Bill Walter, DHG Jermaine Stanley, DHG Tom Tollerton, DHG

Upload: others

Post on 30-May-2020

12 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

1government contracting

DoD Cybersecurity Rules:Government Contractors Need to KnowBill Walter, DHGJermaine Stanley, DHGTom Tollerton, DHG

Page 2: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

2government contracting

Speaker Information

TomTollerton,ManagerDixonHughesGoodman,LLP(704)[email protected]

JermaineStanley,ManagerDixonHughesGoodman,LLP(703)[email protected]

@DHG_GovCon@DHG_Cyber

BillWalter,PartnerDixonHughesGoodman,LLP(703)[email protected]

Page 3: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

3government contracting

Topics for Today

• Introductions• BackgroundofDoDCybersecurityRules• UpdatestoComplianceRequirements• NISTSP800-171Overview• KeyDates• WhatShouldGovernmentContractorsBeDoing?

@DHG_GovCon@DHG_Cyber

Page 4: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

4government contracting

DoD Cybersecurity Rules

Page 5: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

5government contracting

DoD Cybersecurity Rules

InterimRule#1…RequirescontractorreportingofnetworkpenetrationsandimplementedtheDoDCIOCloudComputingSecurityRequirementsGuide(SRG)Version1,Release1onJanuary13,2015.1

ThisruleisintendedtostreamlinethereportingprocessforDoDcontractorsandminimizeduplicativereportingprocesses.2

InterimRule#2ExtendedtimelineforcompliancetoprovidecontractorswithadditionaltimetoimplementsecurityrequirementsspecifiedbyaNISTSpecialPublication(SP)800-171.3

@DHG_GovCon@DHG_Cyber

Page 6: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

6government contracting

DoD Cybersecurity Rules

InterimRule#1…Setforth(i)informationsystemsecurityrequirements;(ii)mandatorycyberbreachreporting;and(iii)cloudcomputingstandardsandprocedures.

Expandedsafeguardingrequirementstocoverthesafeguardingofcovereddefenseinformation(CDI)residingincontractorinformationsystems,andrequiredcompliancewiththesecurityrequirementsintheNationalInstituteofStandardsandTechnology(NIST)SpecialPublication(SP)800–171,‘‘ProtectingControlledUnclassifiedInformationinNonfederalInformationSystemsandorganizations

@DHG_GovCon@DHG_Cyber

Page 7: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

7government contracting

DoD Cybersecurity Rules

(ii)MandatoryCyberIncidentReporting§ Increasednumberofcircumstanceswherecontractorsmustreportincidents.

§ IncidentsmustbereportedtoDoDwithin72hours.§ Howdowedefineanincident?

‒ Incidentvs.Compromise‒ Event?

@DHG_GovCon@DHG_Cyber

Page 8: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

8government contracting

DoD Cybersecurity Rules

(iii)CloudComputerStandardsandProcedures§ EnforcespreviousguidanceissuedbyDoDCIOoncontractingcloudservices

§ Enforces“CloudComputingSecurityRequirementsGuide”‒ FedRAMPcompliancestillrequired,butadditionalcontrolsfor“moresensitiveinformation”

‒ DefinesseveraladditionalclassesofSensitiveData

@DHG_GovCon@DHG_Cyber

Page 9: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

9government contracting

DoD Cybersecurity Rules

NewDefinitions…§ CUIvs.UCTIvs.CDI§ 800-171refersto“ControlledUnclassifiedInformation”

‒ Wasdatedbeforethenewruleswereputinplace§ “UnclassifiedControlledTechnicalInformation”wastheoriginalterminDFARS252.204-7012

§ CoveredDefenseInformation– newtermthatencompassesalloftheabove,aswellasnewtypesofinformation

@DHG_GovCon@DHG_Cyber

Page 10: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

10government contracting

DoD Cybersecurity Rules

CoveredDefenseInformation(CDI)§ UnclassifiedinformationprovidedtothecontractorbyoronbehalfofDoDinconnectionwiththeperformanceofthecontract;or

§ Unclassifiedinformationwhichiscollected,developed,received,transmitted,used,orstoredbyoronbehalfofthecontractorinsupportoftheperformanceofthecontract

@DHG_GovCon@DHG_Cyber

Page 11: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

11government contracting

DoD Cybersecurity Rules

CoveredDefenseInformation(CDI)is…§ Controlledtechnicalinformation(Military)§ Exportcontrolledinformation(commodities,tech,softwareetc.)

§ Criticalinformation(DoDDirective,OPEC,etc.)§ ‘CatchAll’(privacyorproprietarybusinessinformation)

@DHG_GovCon@DHG_Cyber

Page 12: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

12government contracting

DoD Cybersecurity Rules

CoveredContractorSystems§ ContractorownedInformationSystem§ Processes,stores,ortransmitsCDI§ Properscopingiskey

‒ Serversandworkstations‒ Networkdevices‒ Storagesystems

@DHG_GovCon@DHG_Cyber

Page 13: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

13government contracting

Updates to Compliance Requirements

Page 14: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

14government contracting

Updated Requirements

Remember…DoDissuedInterimRule#2amendingtheDefenseFederalAcquisitionRegulationSupplement(DFARS)toprovidecontractorswithadditionaltimetoimplementsecurityrequirementsspecifiedinNISTSP800-171.

@DHG_GovCon@DHG_Cyber

Page 15: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

15government contracting

Additional Updated Requirements § DFARSclause252.204–7012wasamendedtorequirenotificationtheDoDCIO

ofanyNISTSP800–171requirementsthatarenotimplementedatthetimeofcontractaward,within30daysofcontractaward(Doesnotexemptorganizationsfromworkingtoward100%compliance)

§ DFRSprovision252.204–7009andclause252.204–7012wereamendedtorequire,whenapplicable,inclusionoftheclausewithoutalteration,excepttoidentifytheparties.

§ DFARSclause252.204–7012wasfurtheramendedtolimittherequirementtoflowdowntheclauseonlytosubcontractorswheretheireffortswillinvolvecovereddefenseinformationorwheretheywillprovideoperationallycriticalsupport.

§ DFARSclause252.204–7012wasamendedtoremovetherequirementforDoDCIOacceptanceofalternativebutequallyeffectivesecuritymeasurespriortoaward.

@DHG_GovCon@DHG_Cyber

Page 16: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

16government contracting

NIST SP 800-171

Page 17: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

17government contracting

NIST SP 800-171

ProvidesfederalagencieswithrecommendedrequirementsforprotectingtheconfidentialityofCUI:(i)whentheCUIisresidentinnonfederalinformationsystemsandorganizations;

(ii)whentheinformationsystemswheretheCUIresidesarenotusedoroperatedbycontractorsoffederalagenciesorotherorganizationsonbehalfofthoseagencies;and

(iii)wheretherearenospecificsafeguardingrequirementsforprotectingtheconfidentialityofCUI

@DHG_GovCon@DHG_Cyber

Page 18: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

18government contracting

NIST SP 800-171

‘TailoringCriteria'

SP800-171guidelinesaretailoredfornonfederalinformationsystemsthatcontactorsalreadyhaveinplace,withagoalofattemptingtoavoidrequiringcontractorstocompletelyreplacelegacyinformationsystems.

ProvidesacompletelistingofthesecuritycontrolsintheNISTSpecialPublication800-53moderatebaselineandthetailoringactions(byfamily)thathavebeencarriedoutonthesecuritycontrolsinthemoderatebaseline.

– ThetailoringactionsfacilitatethedevelopmentoftheCUIderivedsecurityrequirements

@DHG_GovCon@DHG_Cyber

Page 19: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

19government contracting

NIST SP 800-171

Threeprimarycriteriaforeliminatingasecuritycontrolorcontrolenhancementsfromthemoderatebaselineincluding:§ Thecontrolorcontrolenhancementisuniquely

federal(i.e.,primarilytheresponsibilityofthefederalgovernment);

§ ThecontrolorcontrolenhancementisnotdirectlyrelatedtoprotectingtheconfidentialityofCUI;or

§ Thecontrolorcontrolenhancementisexpectedtoberoutinelysatisfiedbynonfederalorganizationswithoutspecification.

@DHG_GovCon@DHG_Cyber

Page 20: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

20government contracting

Key Dates

August26,2015-expanded

safeguardingrequirementstocovercovered

defenseinformation(CDI)

Dec.14,2015–Publicmeeting

withDoDcontractors

Dec.30,2015–DoDissues

interimruletograntadditional

timeforcontractorstoimplementNISTSP800-171

Dec.31,2017-Contractorsmustcomplywiththe

requirementsofNISTSP800-

171

@DHG_GovCon@DHG_Cyber

Page 21: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

21government contracting

What Should Government Contractors Be Doing?

Page 22: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

22government contracting

What Should We Do?

ExpectationsofContractors§ UnderstandstatusofcompliancewithSP800-171

‒ Beabletocommunicategaps‒ HaveaplanforremediationbyDec.31,2017

§ Haveasystembreachreportingplan‒ Howquicklyareweabletoperformaninvestigation?

@DHG_GovCon@DHG_Cyber

Page 23: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

23government contracting

What Should We Do?

CurrentPriorities…§ Understandcompliancerequirements

§ Thetimetobeginreviewingcontrolcompliancestatusisnow!

§ Breachnotificationrequirementswithin72hours‒ Howdowereport?‒ What’sinvolved?

@DHG_GovCon@DHG_Cyber

Page 24: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

24government contracting

What Should We Do?

CriticalQuestions…§ Doweknowthenatureofourin-scopesystem?

‒ Doweknowexactlywhatdatawehave?‒ Dataflows‒ Systemsthat“transmit,process,orstore”relevantdata

§ Needtoproperlyscopeour“coveredinformationsystem.”‒ Segmentationcandramaticallyreduceorexpandthescopeofcompliancerequirements

@DHG_GovCon@DHG_Cyber

Page 25: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

25government contracting

What Should We Do?

CriticalQuestions…§ Areweeffectivelypushingandenforcingcompliancerequirementswithoursubs?

§ Howareweperformingourcomplianceassessment?‒ Areweusingobjectiveanalysis?‒ Tabletopexerciseorin-depthassessment?‒ Areweusingtoolstoconducttechnicalreviews?‒ Areweimplementingadequateplantoremediategaps?

@DHG_GovCon@DHG_Cyber

Page 26: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

26government contracting

Questions?@DHG_GovCon@DHG_Cyber

Page 27: DoD Cybersecurity Rules: Government Contractors Need to Kno · NIST SP 800-171 ‘Tailoring Criteria' SP 800-171 guidelines are tailored for nonfederal information systems that contactors

27government contracting

Join Us Next Month @DHG_GovCon@DHG_Cyber

DCMAGuidanceUponCompensationBlendingClarifications,Questions,andConcerns

Wednesday,March9th,11:00am


Federal Actions to Enable Contractors to Protect “Covered ... · PDF fileProtect “Covered Defense Information” and “Controlled Unclassified Information ... NIST SP 800-171

SPRS Access for NIST SP 800-171

then-Expansion April 2018 - NIST...[SP 800 -56A] or 170 [SP 800-56B]. 171 The first category consists of a family of one-step key-derivation function, swhich derive 172 keying material

Cybersecurity Challenges - DoD Procurement Toolbox · Unclassified 18 NIST SP 800-171, Protecting CUI in Nonfederal Systems and Organizations Why NIST SP 800-171? •Developed for

CYBERSECURITY UNDER NEW DOD RULES · 2020. 7. 25. · within 72 hours and adopt NIST SP 800-171 as the baseline for covered information system security ... (SP 800-53). Contractors

COMPLIANCE IN THE CLOUD - Wild Apricotsia-web.wildapricot.org/resources/Documents/345-430pm - Compliance... · • NIST SP 800-171 with mapping to NIST 800-53 Relevant ... What is

NIST 800-171, DFARS - Florida Industrial Security Working ...fiswg.research.ucf.edu/Documents/PDF/Protecting CUI and NIST-800... · nist 800-171, dfars responsibilities for defense

Security Standards Compliance NIST SP 800-53 Revision 5 … · 2019. 7. 24. · G. Protecting Controlled Unclassified Information in Non-federal Systems and Organizations, NIST SP-800-171,

Cybersecurity Maturity Model Certification (CMMC) · Department of Defense (DoD) contractors adopt cybersecurity standards that follow the NIST SP 800-171 cybersecurity framework

GUIDANCE FOR ASSESSING COMPLIANCE OF AND ENHANCING ... · Special Publication (SP) 800-171, ^Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

Protecting Controlled Unclassified Information in Nonfederal Information … › ... › NIST-MEP-800-171-Presentation.pdf · 2017-10-18 · § NIST Special Publication 800-171 to

NS0-171.exam€¦ · NS0-171.exam.34q Number : NS0-171 Passing Score : 800 Time Limit : 120 min NS0-171 FlexPod Implementation and

DFARS 252.204-7012, NIST 800-171, CDI … and You · DFARS 252.204-7012, NIST 800-171, CDI … and You • Overview

FISMA & FEDRAMP - Indiana Chamber of Commerce · 2019-01-07 · FedRAMP. Control Family NIST SP FedRAMP FedRAMP NIST SP 800-53 R4 High Moderate 800-171 R1 Baseline Baseline. AC ACCESS

NIST 800-171 EXPLAINED - · PDF fileapply to any organization. | Rapid7.com Compliance uide NIST 800-171 4 ... controls of NIST 800-171 have become a very important measure for security

Are You Ready for NIST SP 800-171?

NNT NIST 800-171 Solution Brief - newnettechnologies.com · NNT Compliance Briefing NIST 800-171 CONTROL FAMILIES NIST 800-171 is a subset of require-ments taken from the NIST 800-53

Welcome to the NIST SP 800-171 Questionnaire (Ref:1.1 ......Welcome 3.1.Access Control Welcome to the NIST SP 800-171 Questionnaire (Ref:1.1) This questionnaire is based on cyber requirements

WOLF designs modules to pass the following environmental … · 2020. 11. 20. · NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems (compliant)

stackArmor - FedRAMP and 800-171 compliant cloud solutions

NIST 800-171 Simplifying CUI and DFARS Compliance

The NARA Rule and NIST SP 800-171 · 2018-03-21 · • 50+ security controls from NIST SP 800-53 ... requirements, taken from NIST SP 800-53’s security controls 20. Requirements

DFARS 252 Assessment Session 208: NIST SP 800 …/media/HDIFusion/Files/speaker-handouts/... · Session 208: NIST SP 800-171 and Controlled Unclassified Information Presented by:

NIST SP 800-171 Questionnaire that all suppliers fully understand their obligations ... For new contracts awarded prior to ... the answers to NIST SP 800-171 questionnaire

DRAFT - HI-PTAC · 2020-04-04 · Awareness and Training: SP 800-171 Security Family 3.2 42

Additions/edits to Version 1.1 are shown in blue NIST SP ... SP... · NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020 Additions/edits to Version 1.1 are shown

Preparing for NIST SP 800 -171 - PilieroMazza › 7A2372 › assets › files... · Preparing for NIST SP 800 -171 January 23, 2018 For the American Council of Engineering Companies

NIST 800-171 & CMMC Compliance Scoping Guideexamples.complianceforge.com/nist-800-171/NIST 800... · This document is intended to help companies comply with NIST 800-171 and prepare

Identifying and Implementing FAR Basic Safeguarding ... · The cross-mapping of FAR controls to NIST SP 800-171 rev. 1 ... corresponding NIST SP 800-53 control, ... privately owned

Withdrawn NIST Technical Series Publication...Oct 01, 2015  · SP 800-171 is superseded in its entirety by the publication of SP 800-171 (includes updates as of January 14, 2016;

CONTROLLED UNCLASSIFIED NONFEDERAL ORGANIZATIONS … · 2018-06-04 · Controlled Unclassified Information Publication (SP) 800-171, Revision 1, Protecting Controlled Unclassified

Controlled Unclassified Information (CUI) Security ... · Security Requirements in NIST SP 800-171, Devin Casey, Program Analyst, Controlled Unclassified Information, Information

NIST SP800-171: Protecting Controlled Unclassified ... · What is NIST SP 800-171 4. In place to protect “Controlled Unclassified Information” (CUI) Tailored NIST SP 800-53 security

CONTROLLED UNCLASSIFIED NONFEDERAL ORGANIZATIONS … · 2019-08-27 · Unclassified Information Publication (SP) 800-171, Revision 1, Protecting Controlled Unclassified Information

Additions/edits to Version 1.1 are shown in blue NIST SP 800-171 … SP 800... · 2020. 6. 24. · 2) Purpose a) The NIST SP 800-171 DoD Assessment Methodology, Version 1.2 documents