Cybersecurity refers to the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access.

The theft of intellectual property and sensitive information from all industrial sectors due to malicious cyber activity threatens economic security and national security. The Center for Strategic and International Studies estimates that the total global cost of cybercrime was a high as $600 billion in 2017. Malicious cyber actors continue to target the Defense Industrial Base sector and the supply chain of the Department of Defense. The aggregate loss of intellectual property and certain unclassified information from the DoD supply chain can undercut U.S. technical advantages and innovation as well as significantly increase risk to national security. Our adversaries are not only interested in acquiring our intellectual property, they are intent upon disrupting the DoD supply chain.
Because much of the Department of Defense’s data resides on contractors’ networks, the DoD has implemented several regulations to help safeguard the data and protect the systems that store and transmit the data.

• Federal Acquisition Regulation (FAR) 52.204-21 - Basic Safeguarding of Covered Information Systems requires that Federal Contract Information (FCI) – information that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government that is not intended for pubic release – be protected. FCI does not include simple transactional information, such as information necessary to process payments. For more information about FCI, go to the “FCU/CUI” tab.

• Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting requires that controlled unclassified information (CUI) be protected. CUI is information that is provided by or generated for the DoD under a contract to develop or deliver a product or service to the DoD that requires safeguarding or dissemination controls but is not classified. In laymen’s terms, it is information that could threaten national security if it were disseminated or used inappropriately by our adversaries. The DFARS clause requires contractors to self-attest to compliance with the 100 controls in NIST SP 800-171.

• Defense Federal Acquisition Regulation Supplement Interim Rule (DFARS Case 2019-D041).  For information about the DFARS clause and the new DFARS Interim Rule, click on the DFARS tab.
  • DFARS 252.204-7019 – requires defense contractors to perform a self-assessment to NIST SP 800-171 and upload their score into the Supplier Performance Risk System in order to be considered for award or contract modifications -  if DFARS 252-204-7012 is referenced in the contract. The self-assessment must be performed every three years.
  • DFARS 252.204-7020 – requires defense contractors to  provide the Government with access to its facilities, systems, and personnel when it is necessary for DoD to conduct or renew a higher-level assessment. The clause also requires the contractor to ensure that applicable subcontractors also have the results of a current Assessment posted in SPRS prior to awarding a subcontract or other contractual instruments.
  • DFARS 252.204-7021 – Cybersecurity Maturity Model Certification (CMMC). To enhance the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), the Under Secretary of Defense for Acquisition and Sustainment has developed the CMMC framework. The model consists of maturity processes and cybersecurity best practices from multiple cybersecurity standards, frameworks and other references, as well as inputs from the broader community. The model encompasses the basic safeguarding requirement for FCI specified in FAR Clause 52.204-21 and the security requirements for CUI specified in NIST SP 800-171 per DFARS Clause 252.204-7012. The CMMC framework adds a certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level, and measures cybersecurity maturity with five levels. For more information about CMMC click on the “CMMC” tab.

Click Here for the Cybersecurity Overview presentation.

NOTE: DoD cybersecurity regulations do NOT apply to contractors that supply strictly commercial-off-the-shelf (COTS) products or sell products to the DoD under the micro-purchase threshold.

The NCMBC and the I3C are not representatives of the DoD or the CMMC Accreditation body. This website is meant to be a community resource for cybersecurity compliance information.