The Government remains intensely focused on how best to protect
its Controlled Unclassified Information (CUI) once it is released
to contractors. In a shift from its initial approach of "we
will take the contractor's word for it," the Department of
Defense (DoD) announced in June 2019 it is in the process of
developing a new cybersecurity certification program for its
contractors, which will involve using third party auditors to
validate contractor compliance with required security controls. In
addition, on June 19, 2019, the National Institute of Standards and
Technology (NIST) released two new highly-anticipated draft special
publications – NIST SP 800-171, Rev 2 and NIST SP 800-171B
– with a tight turnaround time for comments by July
19, 2019.
