What is DFARS?
Defense Federal Acquisition Regulation Supplement: The Catalyst for CMMC & NIST SP 800-171
While there are many DFARS requirements that may affect your organization the following Defense Federal Acquisition Regulation Supplements regarding Cybersecurity and the protection of controlled unclassified information (CUI) are important to understand and adhere to if your company generates any revenue either directly or indirectly from the Department of Defense (DoD) or any DoD-related organization.
No Time to Research?
This Can Get Complicated! Let us Help!
DFARS 252.204-7008
Compliance with Safeguarding Covered Defense Information Controls
Key Points:
- Requires 252.204-7012 security requirements to be implemented for all Covered Defense Information on all covered contractor information systems.
- Introduces NIST SP 800-171 requirements Via DFARS 252.204-7012
Not Sure if You Handle CUI?
Check out this Blog!
DFARS 252.204-7012
Safeguarding Covered Defense Information and Cyber Incident Reporting
Key Points:
- Organization must protect controlled unclassified information (CUI) in accordance with NIST SP 800-171.
- Organizations must report cyber incidents to the DoD within 72 hours of discovery.
DFARS 252.204-7019
Notice of NIST SP 800-171 DoD Assessment Requirements
Key Points:
- Notifies all DIB contractors that they must perform a self-assessment based on the DoD Assessment Methodology a minimum of once every 3 years.
- All DIB contractors must have a current and accurate score posted in the DoD Supplier Performance Risk System.
DFARS 252.204-7020
NIST SP 800-171DoD Assessment Requirements
Key Points:
- Requires contractor to perform and submit a self assessment of their compliance against NIST SP 800-171 in accordance with the DOD Assessment Methodology.
- Requires contractors to flow down requirement to their subs and suppliers.
Would You Pass An Audit?
See how NeQter Stacks up against the Top 10 Requirements that most companies do not meet according to the Defense Contract Management Agency (DCMA).
DFARS 252.204-7021
Cybersecurity Maturity Model Certification Requirements
Key Points:
- Contractors must pass a CMMC assessment and certification must be present at time of award.
- Certification must be renewed via a new assessment every 3 years.
- Requires contractors to flow down requirement to their subs and suppliers.
No Time to Understand or Implement Compliance?
Talk to our compliance experts to evaluate your needs and guide you to the appropriate solutions.
