Proposed FAR Security Incident Reporting Requirements: What You Need To Know

The Federal Acquisition Regulation (FAR) Council issued a proposed rule that, if enacted, would require federal contractors to comply with new security incident reporting obligations and other requirements that would apply to all FAR-covered contracts. Those requirements include security incident reporting in FAR 52.239-ZZ, "Incident and Threat Reporting and Incident Response Requirements for Products or Services Containing Information and Communications Technology," and certification requirements in FAR 52.239-AA, "Security Incident and Reporting Representation." Comments are due December 4.

Security Incident Reporting and Compliance Certification

Under the proposed rule, contractors performing covered contracts must, among other things, report to the Department of Homeland Security, Cybersecurity & Infrastructure Security Agency (CISA), within eight hours of discovery, "all security incidents involving a product or service provided to the Government that