Cyber DFARS Workshop

Contractors to the Department of Defense (DoD) must show compliance with DFARS 252.204-7012 Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting clause by 31 December 2017.

What does this really mean and what is the minimum necessary security controls to demonstrate compliance?  What happens if the contractor can’t comply by the deadline?

DFARS 252.204-7012 specifies the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 as the minimum security standard for protecting both controlled unclassified information (CUI) and CDI.  It also addresses topics such as:

• Security information and event management (SIEM)
• Multi-factor authentication
• Applied encryption, both at rest and in-transit
• Security risk assessments and management
• Policies and written authentication for your security procedures and protocol