In May of 2016, the DoD, General Services Administration (“GSA”), and the National Aeronautics and Space Administration (“NASA”) issued a Final Rule adding a new subpart and contract clause (52.204-21) to the Federal Acquisition Regulation (“FAR”). See 81 Fed. Reg. 30439 (May 16, 2016), available here.
The Final Rule obligates contractors to employ a set of 15 “basic safeguarding” controls for contractor information systems that handle “Federal Contract Information.” The Final Rule does not relieve contractors of obligations from other clauses with heightened requirements, such as those protecting covered defense information or controlled unclassified information. However, the Final Rule creates an interagency baseline for cybersecurity. The vast majority of federal contractors will be covered under the scope of this Final Rule.
Our firm is able to assist with compliance with this Final Rule.