The DFARS clause for covered defense information applies NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations" 1. As codified, the clause points to the version in effect at the time the solicitation is issued or as authorized by the contracting officer 2.
If a requirement does not fit your system, the clause gives you a route: you submit requests to vary from NIST SP 800-171 in writing to the contracting officer 3.
Map requirements to systems
Start from where the information lives, then walk each requirement across it. FAR 52.204-21, the basic safeguarding clause for federal contract information, shows the kind of work involved. It requires you to limit system access to authorized users, processes acting on their behalf, or devices 4; authenticate the identities of those users, processes or devices before allowing access 5; sanitize or destroy media containing federal contract information before disposal or release for reuse 6; identify, report and correct information and system flaws in a timely manner 7; and escort visitors, monitor visitor activity and keep audit logs of physical access 8.
Worked example. Contractor R lists its systems: four laptops, a cloud email account, a shared drive and a locked office. For the media requirement, its table says laptops are wiped before resale by the office manager, with a signed log as evidence. For visitors, it says the receptionist escorts guests and keeps a sign-in sheet. Two cells stay empty, and those become its first fixes.
The system security plan and DoD assessments
For DoD, a Basic Assessment is a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 9, based on the contractor's review of its system security plans 10. The DFARS assessment provision looks for an assessment not more than 3 years old unless a lesser time is specified in the solicitation 11, and summary level scores for all assessments are posted in the Supplier Performance Risk System (SPRS) 30 days after the assessment 12.
The plan should also name who acts when something goes wrong. Under the DFARS clause, rapidly report means within 72 hours of discovery of any cyber incident 13.
Indented paragraphs are invented worked examples. Tool links open Bids2Bank and need a free account.
Next lesson: Representations and certifications: what you are signing