On November 18, the National Institute of Standards and Technology (“NIST”) released Draft Special Publication 800-171 (“SP 800-171”), which includes new recommended security controls for nonfederal organizations such as government contractors, state and local governments, and colleges and universities that “process, store, or transmit” controlled unclassified information (“CUI”) on their own systems.  These draft standards were issued pursuant to Executive Order 13556, Controlled Unclassified Information (“CUI EO”), which called for the establishment of a uniform government approach for managing unclassified information requiring safeguarding or dissemination controls.  The draft standards are based on the security requirements and controls in FIPS Publication 200 and NIST SP 800-53, but were tailored to eliminate requirements that are uniquely federal, related primarily to availability, and/or presumably already routinely satisfied by nonfederal organizations.

To maintain the security of CUI, the CUI EO instructed the National Archives and Records Administration (“NARA”) to collaborate with various agencies to propose CUI classifications and associated markings, and issue any directives necessary to implement the CUI EO.  As noted in SP 800-171, “the CUI program is designed to address several deficiencies in managing and protecting unclassified information to include inconsistent markings, inadequate safeguarding, and needless restrictions, both by standardizing procedures and by providing common definitions” through a federal CUI Registry.  This Registry outlines 22 top-level categories of data, with subcategories covering everything from electronic fund transfers to source selection in the procurement process.  Although the categories of information included in the Registry are unclassified, the government has determined that additional safeguarding – such as storage on a secure server – or limitations on sharing the data should be employed.  To ensure that controls are reasonable and justified , the CUI EO requires each category to be based in statute, regulation, or government-wide policy, and the Registry lists such authorizations.

The contracting community, particularly the defense community, has seen a number of initiatives in response to the CUI EO and the subsequent Executive Order 13,636, Improving Critical Infrastructure Cybersecurity and Presidential Policy Directive 21, Critical Infrastructure Security and Resilience.  Those initiatives have included a new DoD Instruction (8582.01) issued in June 2012 requiring “adequate security” for all unclassified DoD information on non-DoD information systems; DoD’s final rule on Unclassified Controlled Technical Information (“UCTI”) issued in November 2013 providing direction both for protecting UCTI on defense contractor systems and for reporting related cyber incidents, and a proposed FAR rule from August 2012 that remains under consideration.  As a result, non-federal entities are currently subject to a wide range of contract clauses and guidance from different agencies, some of which may be conflicting.  SP 800-171’s standards could provide some consistency for how contractors should handle CUI.

Impact on Contractors:

A key takeaway for contractors is that SP 800-171’s “Notes to Reviewers” provide that a new FAR clause is an expected next step.  Based on this expectation, NIST advises that “[u]ntil the formal process of establishing such a single FAR clause takes place, where necessitated by exigent circumstances, NIST Special Publication 800-171 may be referenced in a contract-specific requirement on a limited basis consistent with the regulatory requirements.”  Thus, contractors should remain alert for contract provisions requiring adherence to SP 800-171.

A second draft of SP 800-171 is expected in March 2015, with a final document completed by June 2015.  Related FAR changes are expected soon thereafter.  NIST is currently seeking comments on SP 800-171 no later than January 16, 2016.  Comments can be emailed to sec-cert@nist.gov.