What is DFARS 252.204-7012? 

• Defense Federal Acquisition Regulations Supplement (DFARS) a requirement to protect "Controlled but Unclassified Information (CUI)" with some basic cybersecurity best practices.  It is required for contracting to sell products or services to the DoD.

Who does it apply to?

• The DFARS applies to any contractor or subcontractor (..or sub-sub contractor) with contracts to sell to the DoD. 

When is it required?

• The date for compliance was December 31, 2017.

What if I ignore it?

• There are no fines or penalties, but contractors are in jeopardy of losing all government contracts if they don't comply.

So how does a contractor comply?  What is involved?

• NIST has created the Risk Management Framework as a master document (SP 800-53) https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-53r4.pdf
• NIST then created a simpler derivative for use with DFARS as document SP 800-171.  https://csrc.nist.gov/publications/detail/sp/800-171/rev-1/final
• The 800-171 document is essentially a checklist of 110 items making up a good cybersecurity program.

That's the bad news, so what is the good news?

• Contractors DO NOT have to conform to all 110 items initially.  They only need to show that they have reviewed the list, identified the gaps, and have a plan to fix them.
• Contractors are not required to be audited by third party or certified inspectors.  They can do the work themselves, and can "self-attest". 

How do contractors show compliance with DFARS?  What documents are required?

• System Security Plan (SSP): This is a description of where you are and gaps.
• Plan of Action and Milestones (POAM):  This is a plan, with dates, of how to fix security gaps.
• Incident Response Plan:  This is the plan to follow if/when a cyber security breach is detected. 

How can 12bar, LLC help?

• We will provide an hour of free consultation explaining the points above.
• We can provide copies of the standards and associated documents.

Then you decide:

• We can train you on how to do the necessary assessment and create the necessary documents yourself.
• We can do the assessment and create the documents for you.