DoD Issues Final Rule On Covered Defense Information Clarifying Contractor Obligations

The US Department of Defense (DoD) issued a rule on Friday, October 21, 2016, finalizing its information security and cyber incident reporting requirements. The rule, Network Penetration Reporting and Contracting for Cloud Services, 81 Fed. Reg. 72,986, finalized with changes the interim rule issued on August 26, 2015, which mandated that both prime contractors and subcontractors safeguard covered defense information (CDI), report on network penetrations and require adequate security from external cloud computing services. As we previously wrote, the DoD's interim rule significantly expanded contractors' obligations through a new clause titled "Safeguarding Covered Defense Information and Cyber Incident Reporting." Under the clause, the scope of information requiring protection expanded beyond unclassified controlled technical information (UCTI) to all DoD contractors at prime and subcontract levels dealing with CDI—a much broader category of protectable information