Contract Vehicle

Supplier Cybersecurity

Minimizing cyber risks for our clients and partners

As technology becomes even more critical to the acquisition process, cybersecurity is at the forefront of everyone’s mind. Booz Allen is taking steps to ensure that our data and internal systems are protected and compliant with applicable laws and regulations. We also must ensure that the data within our subcontractors' control, and transmitted by our subcontract to others, is protected and compliant with these same laws and regulations.

It is critical that our subcontractors can protect all forms of sensitive data. As a firm, we are taking a proactive approach to minimize cybersecurity risks to our national security and government clients. Prime Contractors that are not compliant with these cybersecurity requirements (in particular the DFARS cybersecurity requirements) risk losing further contracts awards, as well as possible impacts to existing contracts. 

It is imperative that our suppliers are aware of the requirements related to DFARS 252.204-7012, NIST SP 800-171, and the Cybersecurity Maturity Model Certification (CMMC) process.

Safeguarding Controlled Unclassified Information (CUI)

In 2017, the Department of Defense (DOD) implemented requirements to enhance the protection of controlled unclassified information (CUI) within the supply chain (DFARS 252.204-7012 and the NIST 800-171). In addition to the reporting requirement, DOD set standards to protect CUI, as recommended by the National Institute of Standards and Technology (NIST) and expected the supplier community to do the same.  

However, over time, the DOD Office of Inspector General found that DOD suppliers were not consistently implementing the mandated requirements for safeguarding CUI. This was partly because DOD relied solely on suppliers to self-report their progress. Thus, DOD implemented a "trust but verify" policy (as espoused by DFARS 252-7019 and -7020) requiring suppliers to complete a self-assessment based on the NIST 800-171 controls and to send their score to the DOD Supplier Risk Performance System database.

FREQUENTLY ASKED QUESTIONS FOR SUPPLIERS

What is the definition of Covered Defense Information (CDI)?

“Covered defense information” is CUI, as described in the Controlled Unclassified Information Registry, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies—and is either:

  1. Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DOD in support of the performance of the contract, OR
  2. Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.
 Where can I find the NIST 800-171 requirements?
What is the purpose of DFARS clause 252.204-7012, -7019 and -7020?

DFARS clause 252.204-7012 was structured to ensure that unclassified DOD information residing on a contractor’s internal information system is safeguarded from cyber incidents, and that any consequences associated with the loss of this information are assessed and minimized via the cyber incident reporting and damage assessment processes. 

 

In addition, by providing a single DOD-wide approach to safeguarding covered contractor information systems, the clause prevents the proliferation of cybersecurity clauses and contract language by the various entities across DOD. 

 

DFARS clause 252.204-7019 and -7020 ensures that prime contractors and subcontractors who create, store, or transmit CUI within their covered information systems and network have done a NIST SP 800-171, Rev. 2 assessment within the last three years and registered it in the DoD SPRS system.  By doing so, suppliers and the government understand how their covered information system compares to the NIST SP 800-171, Rev.2 standard for protecting CUI.

What is the Supplier Performance Risk System (SPRS)?

The Supplier Performance Risk System (SPRS) is a shared data warehouse that provides storage and access to the NIST SP 800-171 assessment scoring information. This database contains the NIST SP 800-171 assessment date, score, scope, and plan-of-action completion date for every vendor location, identified by their Commercial and Government Entity (CAGE) code. Vendors can view their own data and those with the “SPRS Cyber Vendor User” role can manage their basic assessment scores.  

Understanding the Cybersecurity Maturity Model Certification (CMMC) 2.0

The Cybersecurity Maturity Model Certification (CMMC) is a DOD program designed to safeguard sensitive national security information by ensuring that DOD contractors and subcontractors meet the requirements to safely handle CUI.

DOD first released the CMMC in September 2020 and announced CMMC 2.0 in November 2021.

Learn more about CMMC 2.0

Requirements for Software Suppliers (OMB-22-18)

In September 2022, OMB announced mandatory compliance requirements for all federal software suppliers. Memorandum M-22-18 requires all federal agencies and their software suppliers to comply with NIST supply chain security frameworks and supply chain security guidance and includes a timeline for compliance with the rules. The memo requires that software producers/providers give self-attestation that their software or major upgrade follows two NIST framework/security guidance before federal agencies can start using it.  In addition, a software bill of materials could also be required.

View the full Memorandum

Additional Resources for Suppliers

National Defense Information Sharing and Analysis Center ™ (NDISAC) CyberAssist 

  • A  website that provides trusted resources to assist Defense Industrial Base (DIB) companies and suppliers of varying sizes with the implementation of cyber protections, and awareness of cyber risk, regulations, and accountability for their supply chain. 

Booz Allen Supplier Cybersecurity information (PDF) 

  • A publication created by Booz Allen to help inform suppliers and small businesses on the new rules of cybersecurity, the new cybersecurity environment, and the CMMC framework.

Cyber Security Evaluation Tool (CSET) 

  • A DHS tool to help evaluate your organization's industrial control system and information technology and develop your Systems Security Plan (SSP). 

CMMC Requirements Notification (October 2020 Memo) 

  •  A memo from Booz Allen to suppliers on compliance enforcement of the protection of controlled unclassified information (CUI) of  defense contractors by the Department of Defense (DOD) . 

DFARs 252.204-7012 Clause  

  • Requirements for safeguarding covered defense information (CDI) and cyber incident reporting. 

DFARS 252.204-7019 Assessment and Registration Requirements

  • Requirements of implementing NIST SP 800-171 controls, assessing their systems against the NIST controls to protect CUI, and registering their assessment score with DOD before prime contractors are eligible for DOD awards.

DFARS 252.204-7020 Assessment and Registration Requirements

  • Requirements that (1) federal contractors provide access to facilities and personnel to allow the Government to do Medium- and High-level assessment against NIST SP 800-171 controls and (2) flowing the NIST SP 800-171 controls implementation, assessment, and registration requirements to a federal contractor’s supply chain to protect CUI.

Chief Information Officer > CMMC (defense.gov)

  • DOD CIO website about the CMMC project to protect the Defense Industrial Base’s use of CUI from frequent cyber attacks.

NIST Secure Software Development Framework (SSDF)

  • Framework that software providers/producers must follow before implementing software or major software upgrades at federal agencies.

NIST Software Supply Chain Security Guidance

  • Security guidance that software providers/producers must follow before implementing software or major software upgrades at federal agencies.

Tags

Enterprise Contracting Officers Suppliers Partnership Cybersecurity

Related Content

Article

Read More

Article
Article

Read More

Article
Article

Read More

Article
Article

Read More

Article
1 - 4 of 8