Share on LinkedInShare on LinkedIn

ARTICLE · 17 OCTOBER 2016

DoD Clarifies Covered Defense Information Definition In Final Cyber Reporting Rule

The Department of Defense (DoD) on October 4, 2016, issued a rule finalizing cyber reporting regulations applicable to DoD contractors and subcontractors set forth in 32 CFR Part 236.

United StatesGovernment, Public Sector

The Department of Defense (DoD) on October 4, 2016, issued a rule finalizing cyber reporting regulations applicable to DoD contractors and subcontractors set forth in 32 CFR Part 236.  The rule finalizes an interim rule DoD issued on October 2, 2015 and  addresses cyber incident reporting obligations for DoD prime contractors and subcontractors.

Notably, the final rule clarifies the by now well-known definition of the term 'covered defense information' ("CDI").  This same term is used in DFARS 252.204-7012.  This DFARS clause defines CDI to include four different categories: (1) covered technical information ("CTI"); (2) operations security; (3) export controlled information; and (4) any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

See more popular content from