Compliance Deadline Reached For DoD Contractor Security Controls Requirements

Under the Department of Defense (DoD) final Defense Federal Acquisition Regulation Supplement (DFARS) rule on Network Penetration Reporting and Contracting for Cloud Services,¹ DoD contractors maintaining, processing, or otherwise possessing "covered defense information" (CDI) on their own systems must now be compliant with the technical, physical, and administrative security controls outlined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,² as the "grace period" for compliance ended on December 31, 2017.³ The rule's flow-down mandate requires that the applicable contract terms (and therefore the NIST SP 800-171 implementation requirement and deadline) be flowed down to all subcontractors whose performance will "involve" CDI or who are providing "operationally critical support."⁴