Over the years, I’ve sought to provide practical perspectives on the National Industrial Security Program Operating Manual from the Defense Security Service (DSS). Known as the NISPOM, the manual serves as a repository of “must do’s” for Department of Defense (DoD) contractors supporting classified programs.
Given that the protection of classified information and tech systems remains an increasingly complex and constantly evolving challenge, DSS updates NISPOM as requirements shift.
In May, the most recent update was issued in what was called an “Industrial Security Letter” which summarized a number of new, minimum standards referred to collectively as “Conforming Change 2.”
The letter states that contractors cleared for work involving classified information must establish and maintain a program “to detect, deter and mitigate insider threats.” The letter mandates the monitoring of user activity on classified information systems. For example, to track “activity indicative of insider threat behavior.”
User monitoring and other measures now have emerged as requirements – not recommendations – to pursue this line of business with the government.
Keep reading to see the four key changes/provisions in the “new” NISPOM, and what contractors should know about them: https://washingtontechnology.com/articles/2016/10/27/insights-velez-new-cyber-requirements.aspx
After years of gestation, a final rule was promulgated May 16, 2016 to mandate minimum cyber defenses for companies that do government business. This Federal Acquisition Regulations rule – 