DFARS Unclassified Controlled Technical Information (UCTI) Process and Procedures Update

Background June 2011– DoD Proposes New DFARS Rule for Protecting Controlled, Unclassified Information Industry meeting scheduled for November 15, 2011 Comments due December 2011 February 2013 – Executive Order 13636 on Improving Critical Infrastructure Cybersecurity Executive Branch response to Congressional inability to pass legislation October 10, 2013 – SecDef Memo on Protecting Unclassified Controlled Technical Information Instructs AT&L to “take immediate action to improve the protection of unclassified controlled technical information that resides on or passes through defense contractor systems or networks.” November 18, 2013 – DoD Publishes New DFARS Cyber Rule December 16, 2014 – PGI, FAQs, and Media Submission Instructions released February 20, 2015 – Executive Order 13691 on Promoting Private Sector Cybersecurity Information Sharing Cyber Threat Intelligence Integration Center (CTIIC) & Information Sharing & Analysis Organizations (ISAOs) May 12, 2015 – Comments due for NIST 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (Final Public Draft)

DIB Collaboration - US Govt (Today) Utilize a Trusted Community among Government, Public, and/or Private Sector Entities that Enhances Collaboration and Builds Threat Knowledge to Enable DIB Cyber Defense DoD Secretary of Defense Dept of Homeland Security White House/Capitol Hill Critical Infrastructure Partnership Advisory Council (CIPAC) … Agency U S Cyber Command (USCYBERCOM) Senate/House Legislation CIO Defense Industrial Base (DIB) Cyber Program Sector Coordinating Councils (SCCs, ie. DIB SCC) Cyber Security Coordinator Defense Cyber Crime Center (DC3) National Defense Industrial Association (NDIA) Federal Acquisition Regulation (FAR), Defense (DFARS) Defense Security Service (DSS) & Federal Bureau of Investigations (FBI) Critical Infrastructure Information Sharing & Analysis Center (ISAC) International 5EYE DIB Information Sharing Analysis Organization (ISAO) Aerospace & Defense Companies - Partners/Suppliers/Competitors

H.R. 1731: National Cybersecurity Protection Advancement Act of 2015 Tracking Cybersecurity Legislation To Date Cyber Legislation Summary 44 Introduced/Proposed Bills 38 in Committee 4 Passed One Chamber 1 Vetoed & Override Failed in Senate – Keystone Pipeline 1 Acts/Law (Energy Appropriation & Authorization Only) Pending Activity/Regulation NIST 800-171 NDAA Section 941 & 1645 Incident Reporting SECDEF DOD Cyber Strategy (Classification for Critical) Critical Infrastructure Potential Regulation (Framework & C3) Current Concerns Customer Requirements/ Contract Language 2. DFARS/FAR Safeguarding Unclassified Controlled Technical Information (UCTI) & Controlled Unclassified Information (CUI) 3. DOD AT&L Better Buying Power 3.0 includes Cyber for the Product Life Cycle 4. ~30 Cyber related Legislative Proposals 5. Executive Orders focused on Cybersecurity Proposal Sponsor Status H.R. 1560: Protecting Cyber Networks Act Rep. Devin Nunes [R-CA22] Passed House Apr 22, 2015 S. 754: Cybersecurity Information Sharing Act of 2015 Sen. Richard Burr [R-NC] Reported by Committee: Mar 17, 2015 S. 456: Cyber Threat Sharing Act of 2015 Sen. Thomas Carper [D-DE] Referred to Committee: Feb 11, 2015 H.R. 1731: National Cybersecurity Protection Advancement Act of 2015 Rep. Michael McCaul [R-TX] Apr 23, 2015

Cybersecurity Regulation Status PGI & FAQ Released Addressed ambiguities in certain areas but questions remain within industry DoD / industry working practical implementation issues to include Marking DFARS Unclassified Controlled Technical Information (UCTI) AIA DFARS Working Group meeting working on marking and commercial item clarifications UCTI Update at DOD DIB POWG 7 May 2015 MDA DFARS UCTI Regulation Guideline Draft Addressing Supplier Questions and Concerns Working Through Incident Reporting Ambiguity Encrypted laptops; Compromise with no data loss Defense Acquisition University DOD Training planned for Dec 2015

Watch Items Cyber Security Contract Language Agencies / Programs Including Additional Cyber Language in Contracts to Address Protection of Unclassified Program Information Scope Greater than Program Specific Systems Requirements Contradictory / Duplicative Potential for Significant Cost Impact (e.g., Supply Chain) Incident Reporting Inconsistencies with DFARs incident reporting requirements (who, what, when, how) Damage Assessment Program/CO/DAMO independent DOD Backend Process Disparate Agency/Program Guidelines (CUI, definitions, compliance, & reporting) References to both DIACAP & DFARS without RMF PPP, IA Plan, SSP, IA Questions, etc – varied requests NDAA – National Defense Authorization Acts

DFARS UCTI: 65% of new awards DOD wide Source: http://www.acq.osd.mil/dpap/pdi/eb/monthly_contract_distribution_metrics.html

Subcontractors and Supplier The contract clause is in effect as of November 18, 2013, and must be included in all new DoD contracts, including contracts for commercial items.  The contract clause also must be flowed down to all subcontractors regardless of size and to all tiers of the supply chain.  Do I as a supplier need to notify my prime of my status on DFARS Clause 252.204-7012? If a supplier is non-compliant with the NIST cyber security controls outlined in the DFARS Clause 252.204-7012, then the supplier should immediately notify the prime. What are the incident reporting requirements? A supplier must report an incident to the prime within 72 hours of discovery of any cyber incident that affects UCTI and cooperate with the investigation process.  Please note: the cyber incident reporting requirements associated with this DFARS Clause do not negate any additional reporting requirements found in the contract between the prime, subcontractor and the supplier.

Summary Ongoing Progress… DOD & DIB Working Together Contract Language in addition to DFARS UCTI Supply Chain concerns Technology/Architecture Impacts (Cloud Services, Mobility, Enterprise/Segments/Programs) Marking Commercial Items Incident Reporting for UCTI on multiple contracts Damage Assessment by Programs, DOD Program Offices, and/or COs Future Requirements/Potential FAR in Yr 2015 with the NIST 800-171 CUI implies additional controls Better Buying Power 3.0 with Cybersecurity Area Legislative focus on information sharing; upon Law will protection and controls be the focus for legislative proposals