Department Of Defense Issues Final Version Of Key Cybersecurity Rule

On October 21, 2016, the Department of Defense (DoD) issued its final rule on Network Penetration Reporting and Contracting for Cloud Services,¹ amending an interim version issued on August 26, 2015, and revised on December 30, 2015.² While the final rule narrowed the scope of parts of the rule's coverage, the rule remains expansive in scope and prescriptive in application, including mandatory cybersecurity-related contract clauses to be included in DoD contracts and subcontracts.³

Revised Definition of Covered Defense Information

The final version of the rule revises the definition of "covered defense information" (CDI), a term central to the rule's scope, in order to align it more closely with the rule on controlled unclassified information (CUI) recently issued by the National Archives and Records Administration.⁴