DOD Issues Memo On FedRAMP Requirements For Defense Contractors

On December 21, 2023, the Department of Defense (DoD) issued a memorandum (Memo) providing guidance and clarification on the security and cyber incident management requirements applicable for the use of external Cloud Service Offerings (CSOs) by defense contractors subject to Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 "Safeguarding Covered Defense Information and Cyber Incident Reporting." The Memo has significant implications for defense contractors that use external CSOs. This Client Alert summarizes the Memo and describes the most significant impacts for defense contractors.

DFARS -7012 (b)(2)(ii)(D) states:

"If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for