• Skip to primary navigation
  • Skip to content
  • Skip to primary sidebar

McCarter & English Logo

  • People
  • Services
  • Insights
  • Our Firm
    • Leadership Team
    • Social Justice
    • Diversity, Equity & Inclusion
    • Pro Bono
    • Client Service Values
    • Alumni
  • Join Us
    • Lawyers
    • Summer Associates
    • Patent Professionals
    • Professional Staff
    • Job Openings
  • Locations
    • Boston
    • Philadelphia
    • East Brunswick
    • Indianapolis
    • Stamford
    • Hartford
    • Trenton
    • Miami
    • Washington, DC
    • New York
    • Wilmington
    • Newark
  • Share

Share

Browse Alphabetically:

  • A
  • B
  • C
  • D
  • E
  • F
  • G
  • H
  • I
  • J
  • K
  • L
  • M
  • N
  • O
  • P
  • Q
  • R
  • S
  • T
  • U
  • V
  • W
  • X
  • Y
  • Z
  • All
Bankruptcy, Restructuring & Litigation
Blockchain, Smart Contracts & Digital Currencies
Business Litigation
Cannabis
Coronavirus Resource Center
Corporate
Crisis Management
Cybersecurity & Data Privacy
Delaware Corporate, LLC & Partnership Law
Design, Fashion & Luxury
E-Discovery & Records Management
Energy & Utilities
Environment & Energy
Financial Institutions
Food & Beverage
Government Affairs
Government Contracts & Global Trade
Government Investigations & White Collar Defense
Healthcare
Hospitality
Immigration
Impact Investing
Insurance Recovery, Litigation & Counseling
Intellectual Property
Labor & Employment
Life Sciences
Manufacturing
Products Liability, Mass Torts & Consumer Class Actions
Public Finance
Real Estate
Renewable Energy
Sports & Entertainment
Tax & Employee Benefits
Technology Transactions
Transportation, Logistics & Supply Chain Management
Trusts, Estates & Private Clients
Venture Capital & Emerging Growth Companies
  • Broadcasts
  • Events
  • News
  • Publications
  • View All Insights
Search By:
Insights News Contract Stack
Main image for Switches and Sweets: Belsnickel Brings Defense Contractors and Subcontractors New Cybersecurity Controls in Preholiday Revisions of NIST Cybersecurity Publication
Publications|Alert

Switches and Sweets: Belsnickel Brings Defense Contractors and Subcontractors New Cybersecurity Controls in Preholiday Revisions of NIST Cybersecurity Publication

Government Contracts Alert

12.28.2016

If you are aware of German Christmas folklore (and really, who isn’t?), you know that Belsnickel is a legendary companion of St. Nick who carries a switch with which to punish naughty children and a pocketful of sweets to reward good ones. This holiday season, many are feeling the sting of a switch of another kind, this one involving the December 20, 2016, issuing by the National Institute of Standards and Technology (NIST) of a preholiday revision of Special Publication 800-171 (SP 800-171), Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations. If SP 800-171 sounds familiar, it is because the publication is the source of the cybersecurity controls that defense contractors must follow and flow down to subcontractors pursuant to DFARS Subpart 204.73 and its operative clauses (e.g., DFARS 252.204-7008 and DFARS 252.204-7012). Essentially accompanying St. Nick (perhaps Santa Clause may be more appropriate) this season, the NIST’s revised publication may resemble Belsnickel’s switch (pun intended) to contractors who already have existing SP 800-171 controls in place (as the controls have been required, in various forms, since November 2013) or who have started down the road toward SP 800-171 adherence in advance of the DFARS-directed December 2017 deadline. With that in mind, let’s take a quick look at the implications that switch (pun still intended) brings to the security requirements for protecting the confidentiality of CUI in nonfederal systems and organizations:

  • Perhaps the most significant change in the SP is the inclusion of a basic security assessment requirement that requires contractors to proactively create system security plans. While no level of detail in these plans is required, contractors still must “develop, document and periodically update system security plans that describe system boundaries, system environments or operation, how security requirements are implemented and the relationships with or connection to other systems.” (See SP 800-171, 3.12.4.) Accordingly, contractors operating under DFARS Subpart 204.73 are now affirmatively required to create system security plans that are thorough, accurate, and current.
  • There is also a potentially huge substantive change in the sweeping elimination of the word “information” from what once read “information system.” The SP now intends adherents to take a much more “holistic” view of their controls, recognizing that such controls should not be applied to just information systems but also to “industrial and process control systems; cyber-physical systems; and individual devices that are part of the Internet of Things.” While reflecting the realities of our ever-connected modern world, this change also means that defense contractors need to take a much broader view of what “cybersecurity” means to their company and data practices. The good news is that in the SP, “system” is formally defined the same as “information system,” that is, as “[a] discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.” The bad news is that the SP includes the new, undefined term “organizational system” as well. While the definition may be cobbled together through marrying the definitions of “system,” above, with “organization” (“an entity of any size, complexity, or positioning within an organizational structure”), its ubiquity in the SP should give contractors operating under DFARS Subpart 204.73 serious pause when examining the scope of their aforementioned system security plan.
  • The SP also now addresses more clearly the presence of CUI in not only “mobile devices” but also “mobile computing devices.” While this appears at first blush to create a distinction, the change is largely superficial, as the definition of “mobile device” has always included “portable computing device[s]” that include “smartphones, tablets, and E-readers.” (See SP 800-171, 3.1.19.)

The good news is that the revised special publication isn’t without some “sweets” in its pocket:

  • The revised SP more clearly limits its control requirements to focus on CUI. This is actually a nice change in that access-control-derived requirements now are intended to apply to CUI posted or processed on publicly accessible systems and not simply the loosely defined “information” of old. (See SP 800-171, 3.1.22.)
  • The revised SP also expressly allows a carve-out for dedicated video conferencing systems from controls that prohibit remote activation of collaborative devices to secure system and communications protection. The exclusion of these types of conferencing systems allows those systems that rely on one of the participants calling or connecting to the other party to activate the video conference to elude the implications of the SP 800-171 rubric. (See SP 800-171, 3.13.12.)

If, as a contractor, you believed that the government’s cybersecurity requirements would be static and slow to change, then the realities underlying the existence of Santa Claus and Belsnickel may come as a shock. For the rest of you, one thing is very real – contractors need to make sure that cybersecurity planning is at the top of their New Year’s resolutions list. Come this time next year, defense contractors will want to find themselves on the cyber “nice list.” Because in the real world of government contracts cybersecurity, federal regulators are armed with something far bigger than a switch.

sidebar

pdfemail

Related People

Media item: Alexander W. Major
Alexander W. Major

Partner

Related Services

Government Contracts & Global Trade
Cybersecurity & Data Privacy
Subscribe to our Insights
McCarter & English, LLP
Copyright © 2023 McCarter & English, LLP. All Rights Reserved.
  • Login
  • Attorney Advertising
  • Privacy
  • Awards Methodology
  • Contact
  • Subscribe
  • Sitemap

The McCarter & English, LLP website is for informational purposes only. We do not provide legal advice on this website. We can provide legal advice only to our clients in specific inquiries that they address to us. If you are interested in becoming a client, please contact us, but do not send any information about your specific legal question. We cannot serve as your lawyers until we establish an attorney-client relationship, which can occur only after we follow procedures within our firm and after we agree to the terms of the representation.

Accept Cancel