President Signs New Cybersecurity Provisions In Defense Authorization Act

On January 2, 2013, President Obama signed the National Defense Authorization Act for Fiscal Year 2013 (NDAA), which includes both new requirements for cleared defense contractors to share information with the Defense Department (DoD) about cyber intrusions and new cybersecurity procurement opportunities.¹

Reporting and Access Requirements with Respect to Cyber Intrusions

Section 941 of the NDAA gives DoD 90 days to establish procedures requiring "cleared defense contractors"² to report to DoD when "covered networks"³ are successfully penetrated. The procedures must require cleared defense contractors to "rapidly report" to DoD "successful penetration[s]" of covered networks. The reports must describe the technique or method used in the penetration (including a sample of the malicious code, if available) and summarize DoD information that might have been compromised.