The Department of Defense (“DoD”) has updated portions of its internal guidance addressing compliance with the requirements of Defense Federal Acquisition Regulation Supplement (“DFARS”) 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.”

In particular, on December 1, 2017, the office of Defense Procurement and Acquisition Policy updated its Procedures, Guidance and Information (“PGI”) with regard to DFARS 252.204-7012.  The PGI contains both mandatory and non-mandatory internal DoD procedures, guidance, and supplemental information.  Although the PGI is internal to DoD, it provides contractors with insight into how DoD interprets its own regulations.  Notable changes to the guidance include the following:

• Clarifies that the requiring activity’s obligation to notify the Contracting Officer (“CO”) when covered defense information (“CDI”) or operationally critical support is expected in contract performance extends to individual task and delivery orders.
• Directs the requiring activity to create a “work statement or specification that includes the identification of covered defense information or operationally critical support.”  This section is consistent with DoD statements to industry in the past year that procuring entities are responsible for notifying contractors when contract performance involves CDI.
• Explicitly requires the CO to ensure that both the solicitation and resultant contract, task order and/or delivery order “includes the requirement (such as a contract data requirements list), as provided by the requiring activity, for the contractor to apply markings, when appropriate, on covered defense information.”
• Removes statements that (i) the safeguarding requirements apply until such time as the requiring activity removes or changes the designation, and (ii) the CO must coordinate with the requiring activity about disposition of CDI associated with a contract.
• Restates that in cyber incidents involving multiple contracts, DoD is responsible for designating one point of contact to coordinate “additional actions required of the contractor, on behalf of affected DoD components.”  This is consistent with the appointment of a Damage Assessment Management Office (“DAMO”) currently contemplated by current DoD guidance, but this updated PGI explicitly states that the affected contractor should receive direction from only one CO on behalf of all affected DoD components.
• Specifies that once the damage assessment is complete, the requiring activity must provide the CO with a report that documents “actions taken to close out the cyber incident.”  Previously, the guidance required the requiring activity to provide the CO with a “report documenting the findings from the damage assessment activities affecting covered defense information,” with a copy to the contractor.  As revised, the requirement to provide a copy of the report to the contactor has been eliminated.

These updates are consistent with DoD’s attempts to clarify the interpretation of DFARS 252.204-7012 ahead of the implementation deadline of December 31, 2017.  Expected next are revised Frequently Asked Questions that will incorporate some of the learning from DoD’s June 23, 2017 Industry Day on this clause.