DFARS Compliance

The Defense Federal Acquisition Regulation Supplement (DFARS) is a set of regulations developed by the United States Department of Defense (DoD) to manage defense procurement processes. The DFARS allows the United States Armed Forces to acquire quality supplies and services that satisfy mission capability and operational support at a fair and reasonable price.

These regulations aim to enhance the security of contractor information systems, protect intellectual property and protect the confidentiality of defense projects.

DFARS cybersecurity compliance serves as a crucial framework for defense organizations and DoD contractors to establish comprehensive cybersecurity protections and safeguard government information effectively. Complying with this regulation ensures they contribute to the overall national security and the protection of vital defense assets from potential cyber threats.

Demystifying Cybersecurity Requirements

Get your business prepared for compliance by learning the key cyber requirements for government contractors.

Download Now

DFARS is a broad set of regulations that control how the United States Department of Defense (DoD) procures products and services. It also regulates how the contractors and subcontractors that make up the Defense industrial base (DIB) must interact with the DoD throughout the procurement lifecycle. As such, the DFARS covers topics such as the insurance, tax and accounting standards that certain contractors must be able to satisfy when working with the DoD.

Related articles:

• FAR vs DFARS
• What is the Federal Acquisition Regulation?

Importantly and the focus of this article, the DFARS also sets the cybersecurity requirements and cyber incident reporting procedures for those in the DIB who handle controlled unclassified information (CUI) and covered defense information (CDI).

DFARS cybersecurity compliance is crucial for organizations that want to do business with the DoD or work on contracts that involve sensitive information.

Protection of Controlled Unclassified Information

CUI is further categorized into two subsets: CUI Basic and CUI Specified.

• CUI Basic refers to the controlled unclassified information that the authorizing law does not have specific handling requirements. CUI Basic is handled in the way set forth by the Code of Federal Regulations (CFR) and the CUI Registry.
• CUI Specified has specific handling controls that differ from those in CUI Basic. These controls may be more stringent or may simply be different than those required in CUI Basic.

It's important to note that CUI Specified is not a higher level of CUI but different from CUI Basic.

DFARS Clause 252.204-7012, titled "Safeguarding Covered Defense Information and Cyber Incident Reporting," is of particular importance. It mandates that contractors and subcontractors must implement the security requirements specified in the National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171) to protect CUI.

To comply with DFARS, contractors must self-assess their compliance with NIST SP 800-171 and in some cases, they may also be subject to third-party assessments. The goal is to ensure that defense contractors have adequate security measures in place to protect CUI.

NIST SP 800-171 provides the controls and security requirements for protecting Controlled Unclassified Information and DFARS incorporates these requirements into regulations applicable to defense contractors. Contractors working with the U.S. Department of Defense (DoD) must comply with DFARS 252.204-7012 to protect CUI and meet contractual compliance obligations.

NIST SP 800-171 is a compliance framework of controls with guidelines and requirements to enhance cybersecurity and protect Controlled Unclassified Information (CUI) within nonfederal systems and organizations. While it may apply in contracts outside of the DoD, it also serves as a framework for defense contractors and suppliers to comply with the requirements outlined in the DFARS. Additionally, NIST SP 800-171 is the foundation for Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance, which is expected to be defense contractors' most prevalent cybersecurity compliance target.

The main objectives of NIST SP 800-171 are to establish a baseline of cybersecurity practices and improve the overall security posture of systems storing, processing or handling CUI. By implementing these standards, organizations can effectively mitigate risks associated with cyber threats, including unauthorized access, data breaches and information loss. Implementation of NIST SP 800-171 controls is required for businesses, either prime or subcontractors, seeking to participate in DoD contracts that involve CUI.

DFARS 252.204-7012 compliance is related to CMMC, another set of regulations that are not yet finalized by the DoD. CMMC is an additional framework introduced by the DoD to ensure that organizations possess sufficient security measures to protect CUI and CDI.

CMMC will provide a standardized method for assessing and certifying the cybersecurity practices of defense contractors. Once CMMC requirements have been solidified by the governing bodies, meeting its requirements will be a component in demonstrating the ability to safeguard CUI and CDI and comply with DFARS.

DFARS cybersecurity compliance is necessary for organizations dealing with CUI and CDI. The introduction of CMMC highlights the importance of demonstrating sufficient security measures through certification. Understanding the different subsets of CUI and the specific security measures they demand is essential for achieving compliance and ensuring the protection of sensitive defense information.

Non-compliance with DFARS cybersecurity regulations poses risks for organizations operating within the defense sector. Failing to adhere to these regulations can result in detrimental consequences, including contract termination, potential fines, suspension or debarment from future government contracts, criminal prosecution in severe cases, increased cyber risks and potential data breaches.

If an organization fails to meet the required standards, the government may have the right to terminate the contract, which could lead to cessation of work and financial losses. Potential fines may be imposed because of non-compliance, placing further strain on the organization's financial resources.

Non-compliance can also result in suspension or debarment from future government contracts. Organizations that do not meet the DFARS cybersecurity regulations may lose their eligibility to bid on or be awarded DoD contracts in the future, impacting their revenue and reputation in the market.

In severe cases, criminal prosecution may be pursued against non-compliant parties. This can lead to penalties for individuals involved in fraudulent or illegal practices.

Failure to comply with DFARS cybersecurity regulations can also increase cyber risks. Non-compliant organizations may lack adequate cybersecurity safeguards, making them vulnerable to cyberattacks and data breaches. The consequences of such breaches can include reputational damage, financial losses and legal liabilities as is the case with SolarWinds and the recent SEC charges against the company for fraud and internal control failures.

Complying with DFARS cybersecurity controls is essential for organizations operating within the defense sector to protect their contracts, reputation and overall business operations.

Meeting DFARS cybersecurity compliance involves implementing the security requirements outlined in NIST SP 800-171. Here are some tips to keep in mind:

1. Understand applicability: Determine whether DFARS applies to your organization based on the type of contracts you have with the U.S. Department of Defense (DoD).
2. Conduct a security assessment: Perform a comprehensive assessment of your organization's security posture against the 14 families of security requirements in NIST SP 800-171.
3. Create an SSP: Develop a System Security Plan (SSP) that documents how your organization is implementing and managing the security requirements. Make it a living document that is regularly updated.
4. Plan and Prioritize: Develop a plan of action to address any gaps or deficiencies identified during the security assessment and prioritize the implementation of security controls accordingly.
5. Implement security controls: Actively implement the security controls specified in NIST SP 800-171. This includes measures related to access control, incident response, configuration management and more.
6. Train employees: Provide security awareness training to employees to ensure they understand their roles and responsibilities in safeguarding Controlled Unclassified Information (CUI).
7. Control access: Enforce strict access controls to ensure that only authorized individuals have access to CUI. This includes user authentication, role-based access and encryption.
8. Encrypt all data: Implement encryption for CUI both in transit and at rest to protect the confidentiality and integrity of the information.
9. Monitor and respond: Establish monitoring capabilities to detect and respond to security incidents promptly. Develop an incident response plan and regularly conduct drills.
10. Supply chain management: Assess and ensure that your subcontractors and suppliers also comply with DFARS requirements. This is crucial for the security of the entire supply chain.
11. Maintain documentation: Keep thorough records and documentation of your security practices, assessments and any security incidents. This documentation will be essential for audits and compliance verification.
12. Prepare for audits: Be prepared for audits to demonstrate compliance. Maintain transparency and cooperation during any assessments conducted by the government or third-party assessors.

Centralizing the management of projects, people and finances improves operational efficiency and provides real-time insights to support compliance and security needs. Deltek understands what oversight agencies like the DCAA are seeking with an audit and has an easily accessible repository of resources to address each audit need. Support for FAR, CAS and DCMA compliance needs is woven into the fabric of Deltek government contracting solutions and our integrated cloud offering enables the secure storage of your data.

Deltek’s Costpoint GCCM has achieved FedRAMP Moderate Ready status and is listed on the FedRAMP Marketplace and also supports ITAR data storage. Deltek also has future plans for the support of CMMC compliance. From securing a contracting opportunity to final delivery, Deltek has made security a priority for every stage of the project lifecycle.

Elevate Your Cybersecurity and Compliance with Costpoint

Learn how Deltek’s Cloud protects your data from cyber threats and facilitates compliance with FAR and DFARS regulations.

Watch Webinar Now