Data protection and cybersecurity have been receiving
ever-increasing attention within the U.S. federal government. Last
October, the DoD issued two final rules that changed the U.S.
Department of Defense ("DoD") Federal Acquisition
Regulations Supplement ("DFARS") at 48 C.F.R. sections
204.73, Safeguarding Covered Defense Information; 252.204-7008,
Compliance with Safeguarding Covered Defense Information Controls;
252.204-7009, Limitations on the Use or Disclosure of Third-Party
Contractor Reported Cyber Incident Information; and 252.204-7012,
Safeguarding Covered Defense Information and Cyber Incident
Reporting.1 These provisions, in short, require DoD
contractors to provide adequate security to safeguard "covered
defense information" on its unclassified information systems
that support the performance of work under a DoD contract, and to
report cyber incidents – as defined in the regulations
– that may affect such companies unclassified information
systems and/or
