NIST 800-171 has a variety of requirements that are meant to ensure that sensitive information that resides on a contractor’s system remains protected. One set of requirements mandates that mobile devices follow information security protocol in order to guard against a breach. This requires contractors to devise and apply a solution so their employees do not have to carry a separate device for work matters. The good news is there are solutions available that allow employees to work on their own phones.

An organization cannot simply allow users to connect to its system from their own mobile device. This would make the information housed on the system rife for hacking. Mobile devices can carry malware which can infect the information system of the employer. In order to prevent this, there must be multi-factor authentication and other strong security protections in order for the employee to access controlled unclassified information from their mobile device. In the past, this was extraordinarily difficult to accomplish.

Now, much of the focus of securing this information is on the data itself as opposed to the device, allowing users to bring their own device. This is done through a containerized workspace that can completely separate business data from personal data. This will segregate the personal functions on the phone and keep them entirely walled off from the business functions, allowing employees to access work information without being imbued with anything originating from the personal side.

Still, not every type of architecture can satisfy the mobile requirements of NIST 800-171. There must be an effort focused on making this data difficult to access. In other words, a user should not be able to simply go on to their mobile device and immediately be able to access any sensitive information that they wish. Companies should consider biometrics and password management solutions in addition to multi-factor authentication. This should be used in conjunction with 256-bit encryption to protect the sensitive data and allows for a secure solution that can be integrated with a user’s own device.

When this system is successfully in use, the information will be compartmentalized on the employee’s device. Should they no longer need or have permission to access the data, it can easily be removed from the user’s device without affecting anything else housed on the device? Ensuring a physical partition on the mobile device is one of the only ways that will permit companies to allow employees to use their personal devices for work. Outside of that, the company will have to provide not only the device but will have to pay for a monthly service for its employees.

It is imperative that users apply the same cybersecurity principles and rules to mobile devices. NIST 800-171 demands it, and if contractors do not follow these cybersecurity standards, they will eventually be out of the government contracting business. Should their networks be breached from a mobile device, the contractor will face serious business and reputational consequences. For more information about NIST 800-171 requirements, contact ComplyUp.

Much of the United States’ response to the cybersecurity threats facing the nation is a result of coordination between companies and other entities. The underlying assumption is that when information is shared, there is a more effective response to the threats. With that in mind, the Department of Defense initiated the Defense Industrial Base Cybersecurity Program. Recently, Symantec, an industry leader in cybersecurity, announced its plans to join the program.

The DIB Cybersecurity Program is a public-private partnership that provides participants in the program with classified and unclassified information regarding potential threats. In addition, participants also receive best practices regarding information assurance to assist them in their own cybersecurity efforts. By participating in this program, contractors can receive the information necessary to help them exercise better situational awareness with regard to any threats that could potentially compromise the information that is on their systems. At the same time, the participants in the program can share information that they have learned through their own cybersecurity efforts. While companies have their own proprietary processes, the information that they feed into the program can help improve the overall national cybersecurity defense effort.

The DIB Cybersecurity Program is not open to every contractor. In order to join, a contractor will need to have security clearance, the permission to view classified information, and the clearance level to view the particular type of information that they are seeing. While compliance with cybersecurity standards is mandatory, participation in the information-sharing program is voluntary. For this particular program, contractors put their profit motives aside in order to cooperate for the greater good. The program operates under the theory that cooperation works best to protect vulnerable information systems.

Symantec is one of the larger information security companies in the United States. The company has 123 million attack sensors and 175 million protected endpoints at its disposal. Its participation in the program is seen as bolstering cybersecurity defense since there is a national interest in strengthening a large cybersecurity contractor. At the same time, the information that Symantec can share will aid national security since it is one of the companies that is best positioned to learn of new cybersecurity threats as they emerge.

Symantec has been active in providing solutions that assist with NIST 800-171 compliance, which are cybersecurity standards with which companies must certify their compliance in order to do business with the federal government. They are aimed at protecting sensitive information that is housed on contractors’ business systems. Compliance companies such as ComplyUp have been helping government contractors implement the requirements of these standards and can help these contractors stay on top of necessary developments.

The NIST standards have been one of the latest moves in a growing federal government effort to combat the myriad of cybersecurity threats facing the country. Recent examples of hacks have exposed the vulnerability of many information security systems. As a result, cybersecurity defense has been a major priority of the Trump Administration.

Maryland-based DoD Contractors who use ComplyUp’s DFARS/NIST 800-171 Compliance Solutions may qualify for financial assistance through The Maryland Defense Cybersecurity Assistance Program (DCAP).

Defense contractors are prevalent in the areas surrounding Washington DC, particularly Maryland and Virginia, and have a large impact on the economy, as they amount to a sizable proportion of the tax base in these areas. In fact, defense contractors in Maryland have $57 billion of economic impact annually.

To ensure businesses continue to grow and become profitable, the State of Maryland is now providing contractors with assistance in complying with the new DFARS cybersecurity standards, administering a program to distribute federal grant dollars to local contractors to help them become compliant with these rules.

Compliance with these standards is an existential issue for those that do business with the federal government. If these businesses fail to account for and follow these new rules, they will lose the ability to get new contracts and even keep their existing ones. As a result, it is in Maryland’s best interests to help its contractors remain in business. If Maryland contractors can no longer do business with the federal government, the work will simply migrate to other states and Maryland will become less competitive.

The new program is administered by a public-private partnership that is aimed at supporting the defense contracting industry in Maryland, and is run by the Maryland Defense Cybersecurity Assistance Program. Specifically, this program is funded by the Maryland Department of Commerce and is run by the Maryland Manufacturing Extension Partnership. This partnership counts both state government agencies and industries as its members.

There are three different types of grants available. Contractors can receive assistance for NIST 800-171 gap analysis, remediation, or tools, hardware and software services.

The program itself imposes requirements on who is eligible to participate. First, contractors must have a physical location in the State of Maryland. They must also derive at least ten percent of their revenue from work related to the Department of Defense. Alternatively, they should have a procurement request for compliance with the DFARS rule. The program is funded by Department of Defense’s Office of Economic Adjustment and is administered by the Maryland state government.

Compliance with these rules is a pressing issue for contractors who not only have to follow the standards themselves, but also make sure their subcontractors are in compliance. Since the money that funds this program comes from the Department of Defense, there are similar programs in other states, such as Indiana and New York. Each program has its own specific rules for participation unique to that particular program.

For contractors, these new rules present a challenge that can be costly and time-consuming. Government suppliers are better off if they can take advantage of every resource available to cut their own costs of compliance with the NIST standards. By fully complying with these requirements, contractors can maintain their business with the federal government.

Getting NIST 800-171 Compliant isn’t just about satisfying a regulation, it’s smart business. Hacks can come from anywhere and target anyone. Not only can your business get in hot water with the government for failing to be compliant, you could be in an even bigger mess if a hack is the result of negligence on your part.

Recent hacks of systems belonging to United States companies have been validation of the reasons behind the new cybersecurity rules that contractors must follow in order to do business with the United States Government. Foreign nation-states have been behind several large scale hacks and have managed to penetrate the systems belonging to several contractors. While the NIST standards and DFARS rules have been effective for some time, contractor information systems are still at risk of foreign penetration efforts.

Several high-profile intrusions and information thefts caused a change in the way that the government views its information and the contractors whose information systems house it. While the government must take pains to protect sensitive information, contractors were not subject to standards for their own systems, even though they could function in the same role as the government. This changed with NIST 800-171 which contained cybersecurity standards that contractors must follow. These are requirements for anyone hoping to obtain or keep a contract with the federal government.

Even with the new rules, problems still abound. Hackers from China have been active in trying to access contractor systems. In some instances, they have been effective. It has been reported that Chinese hackers have accessed the systems of numerous contractors who do business with the United States Navy. In addition, when the computers belonging to Marriott Starwood were breached, the hackers gained access to information about movements of United States Government personnel.

Even though there are new standards in place, the risk of cyber attacks has not gone away. If anything, hackers associated with nation-states are doubling their efforts to gain entry to sensitive information stored on contractor business systems. While the effective date of these standards has passed, there are still many issues because not every contractor is in full compliance yet. Further, every subcontractor must also comply with these rules. Oftentimes, these subcontractors are smaller entities that have trouble mustering resources to fully comply with these rules. Eventually, the contractors will be held responsible for the errors of their subcontractors because the onus is on them to make sure that they enter into subcontracts with those in compliance. In essence, hackers are doing what they can to test the systems of contractors, knowing that they may still not be fully compliant with new cybersecurity rules.

The threat and the intrusions are not limited just to Navy’s contractors. The Department of Defense has its own vulnerabilities that China and other nations are trying to exploit. Even information pertaining to ballistic missiles is at risk of being misappropriated by foreign entities.

To the extent that contractors can take steps to protect their information systems, they must do so. Not only do contractors have an obligation to the government with whom they transact, but taking vigorous steps to enhance cybersecurity is also a good business practice. Cyber breaches are both costly and embarrassing and many businesses have trouble surviving the hit to their reputation if their laxness leads to a large-scale theft of information from their systems. Compliance solutions can help companies take steps to shore up their systems.

Big changes are on the way when it comes to controlled unclassified information. There is an amendment to the Federal Acquisition Regulation that will apply certain requirements for security to contractors outside the Department of Defense. Additionally, some of the underlying requirements may be changing because more stringent cybersecurity measures may be required by government agencies.

The new government contracting rule addresses how contractors deal with CUI. This involves information that is sensitive, but not considered to be classified. Federal government contracts will need to include a provision that dictates how contractors will dispose of CUI that they gain in the course of performance of their government contracts. The new rule will also include provisions for safeguarding and marking of CUI. The FAR case is based off of a rule that was issued in 2016, and applies to the executive branch. Now, it will be required to apply to contractors as well.

Since this new rule will be in the FAR, it will be a factor in whether contractors are eligible for award and whether they have complied with their contracts. Government agencies will likely have to make this clause mandatory in all of their contracts that are signed. Cybersecurity may also well become an evaluation factor in many contracts that involve the use of information systems.

Optional Cybersecurity Measures

NIST 800-171 serves as the basis for this rule. It requires “adequate security” for the information. However, NIST 800-171 will soon be changing. Agencies will be able to prescribe that contractors follow even more stringent measure to protect CUI. “Adequate security” will simply be the baseline, but agencies may be able to ask for more and contractors will need to comply. Contractors could choose to implement this level of security on their own, even if they are not required to do so by the agency.

NIST 800-171 provides the bedrock principles and protection measures when dealing with CUI. However, this area is rapidly changing as the regulatory agenda moves towards greater cybersecurity protection. Those who do business with the federal government can expect further continued evolution in this area.

Government Assistance

As the new rules take hold and more entities within government assert their right to audit contractors for compliance, there are many issues with figuring out who the proper entity is to conduct the audit. Without a single unified regulator, contractors could be aiming for compliance with different targets. Multiple regulator authority often creates unnecessary confusion. There will likely be a single entity in the future to assess compliance with these rules. Currently, contractors certify their own compliance and then are subject to audits. In the future, there will be more clarity about the process, especially when audits are conducted by a single federal entity.

Given the rapid changes in cybersecurity requirements when dealing with the federal government, your business is best off getting as much help as possible. There are NIST 800-171 compliance solution that are available that can help your business keep track of and meet these ever-changing requirements.

In the wake of the effectiveness of NIST 800-171 and its incorporation into the DFARS, you may be wondering how your business can best comply with the new requirements. Whatever compliance method you choose, the stakes are very high for your business, as failure to comply with these requirements can have dire consequences, such as the loss of contracts with the Department of Defense. Still, you do not want a solution that will cost too much and render your business unprofitable. The process that goes into choosing a compliance solution can be difficult. For some, it may make sense to hire a consultant but for many, this is too pricey of an option.