Many Department of Defense contractors had been dreading the end of 2017. Strict new DoD rules said they had to meet detailed cybersecurity and incident reporting requirements before 2018. Otherwise, they would lose their contracts. Now firms that feared missing the deadline have been given a lifeline. RegDOX Solutions reported the news from Nashua, New Hampshire, on December 27, 2017.
The relief came from Ellen Lord. She serves as Undersecretary of Defense for Acquisition, Technology and Logistics. She recently testified before Congress about the year-end deadline under DFARS and NIST Special Publication 800-171. Her remarks carried both good and bad news for contractors, though the good news weighed more.
The good news
DFARS section 252.204-7008 seems to leave no room for doubt. It says a contractor will implement the 110 controls of 800-171 no later than December 31, 2017. Despite that wording, Lord told lawmakers that for this year a company only has to lay out its plan. A related clause, 252.204-7012, adds a reporting duty. For contracts awarded before October 1, 2017, the contractor must notify the DoD Chief Information Officer of any missing 800-171 controls. That notice is due within 30 days of award.
The bad news
Still, a plan has to be more than a promise to comply someday. Lord pointed to the need for a template. A contractor would measure itself against it and then simply report compliance. One commentator wrote about her testimony. The writer warned that companies ignoring the rules could lose current contracts and be barred from new government work.
In short, meeting the year-end deadline has become easier. However, a contractor without a working solution still risks losing its DoD business.
RegDOX says it offers a ready-made compliance plan for smaller defense contractors and subcontractors. The package covers gap analysis and remediation, plus a plan of action with milestones. The firm has delivered the same work to DoD contractors over the past year. The company says it can put this in place for a client before the end of 2017.
