The United States Department of Defense (DoD) recently published two new rules that impose broader obligations to safeguard information that falls within specified categories of sensitive data and to report cyber incidents to the government.
These rules generally apply to companies that have been awarded new DoD procurement contracts, that hold subcontracts under such DoD contracts, or, in some cases, that have been awarded other types of agreements with DoD.
The rules:
- expand contractors’ and subcontractors’ safeguarding responsibilities and obligations to report and investigate cyber threats;
- modify the scope of data that contractors and subcontractors must safeguard and the universe of contractors and subcontractors to which the requirements apply;
- establish requirements for contractors and subcontractors using cloud computing to provide information technology services to DoD, including requiring such contractors to keep government data within the United States, implement DoD-approved safeguards, and limit disclosure of and access to government data;
- expand and make mandatory DoD’s previously voluntary cyber incident reporting system for defense industrial base (“DIB”) agreement holders; and
- open DoD’s voluntary cybersecurity information sharing program up to a greater range of agreement holders.
Keep reading this article at: http://www.mondaq.com/article.asp?articleid=453834
