On June 19, 2019, the National Institute of Standards and Technology (“NIST”) announced the long-awaited update to Special Publication (“SP”) 800-171 Rev. 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, which includes three separate but related documents.

First, NIST has announced an update to SP 800-171 Rev. 1, which is referred to as SP 800-171 Rev. 2. NIST characterizes the changes in SP 800-171 Rev. 2 as only “minor editorial changes,” including reordering the document and updating the contents of the Appendices. NIST emphasized that there are no changes to the basic or derived security requirements in Rev. 2; in other words, the same 110 total security requirements to ensure the confidentiality of CUI under SP 800-171 Rev. 1 remain unchanged in SP 800-171 Rev. 2. NIST notes, however, that a “comprehensive update” to SP 800-171—including updates to the basic and derived security requirements—“will be forthcoming” in Revision 3; the publication of Revision 3 will follow NIST’s upcoming final draft of SP 800-53, Security and Privacy Controls for Information Systems and Organizations “which will include modified control families, privacy integration, and make other conforming edits that are necessary.”

Second, NIST has announced the publication of an entirely new document, SP 800-171B, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: Enhanced Security Requirements for Critical Programs and High Value Assets, which was drafted in response to what has been characterized by NIST as “an ongoing barrage of serious cyber attacks,” resulting in the loss and/or exposure of controlled unclassified information (“CUI”) that, in turn, prompted the Department of Defense (“DoD”) to request additional guidance from NIST. NIST describes SP 800-171B as a supplement to SP 800-171 Rev. 2 that contains recommended enhanced security requirements designed to protect designated “high value assets” or “critical programs” that contain CUI that are of interest to advanced persistent threats (“APTs”).

NIST characterizes the enhanced security requirements in SP 800-171B as providing the foundation for a “new multidimensional, defense-in-depth protection strategy that includes three, mutually supportive and reinforcing components: (1) penetration resistant architecture; (2) damage limiting operations; and (3) designing for cyber resiliency and survivability.” Indeed, NIST specifically recognizes that these requirements are necessary because the basic and derived requirements in SP 800-171 Rev 2, which are currently required by the Defense Federal Acquisition Regulation Supplement (“DFARS”) 252.204-7012, “are not designed to address the [advanced persistent threat (“APT”)].” NIST also recognizes that many contractors may require the assistance of third parties to implement these enhanced requirements and that “despite the best protection measures implemented by organizations, the APT may find ways to breach or compromise those primary boundary defenses and deploy malicious code within a defender’s system.”

The enhanced security requirements of SP 800-171B are organized into the same 14 security requirement families as SP 800-171 Rev. 2, although there are no enhanced security requirements associated with four of the 14 families: Audit and Accountability, Maintenance, Media Protection and Physical Protection. There are enhanced security requirements associated with the remaining ten families, with more than a third of the total enhanced security requirements associated with the System and Information Integrity and Risk Assessment families. Each requirement is followed by a “discussion section” that is intended to provide additional information to facilitate the implementation and assessment of the enhanced security requirements.

Third, NIST has announced the publication of a DoD cost estimate, Request for Comments on Draft NIST Special Publication (SP) 800-171B, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations – Enhanced Security Requirements for Critical Programs and High Value Assets (the “Cost Estimate”). The Cost Estimate makes clear that the enhanced security requirements under SP 800-171B are focused on designated high value assets or critical programs that contain CUI (i.e., are, at least in theory, intended to apply to a more narrow subset of contractors than those subject to the requirements of SP 800-171 under DFARS 252.204-7012), which will be designated on a contract-by-contract basis. In total, DoD has estimated these requirements “will affect less than [0.05%] of an overall contractor base” that currently processes DoD CUI.

The Cost Estimate also analyzes the costs associated with the implementation and maintenance of the SP 800-171B requirements, which it characterizes as “typically being an allowable contract cost to the government.” The Cost Estimate identifies Systems and Communication Protection requirement 3.13.4e (“employ physical and logical isolation techniques in the system and security architecture”) as the “primary factor” impacting the cost of implementation. The Cost Estimate further explains that this requirement “generally means isolating the IT environment where critical program capabilities are developed from the IT environment processing other CUI, or developing commercial products.”

Impact on Contractors

Although the ultimate impact of the publication of SP 800-171B is not entirely certain, it is clear that the government intends to impose the enhanced security requirements of SP 800-171B on a contract-by-contract basis when, in the government’s assessment, a contract involves designated high value assets or critical programs that contain CUI of interest to APTs.

Although DoD has stated the requirements will only apply to a very small subset of government contractors, how broadly these requirements will apply remains uncertain. Given the government’s increased focus on protecting its information from cyber threats, it is conceivable that DoD may ultimately impose the enhanced security requirements of SP 800-171B on more than just the 0.05% of contractors that DoD currently projects. In the short term, contractors should assess whether they need outside expertise to meet these requirements and ensure that they are ready to respond to an incident should one occur—for example, not only by ensuring incident response plans are updated, but also by periodically testing the plans with scenarios involving APTs . As NIST notes in SP 800-171B, the Government recognizes that an APT may get through even the best protection measures; nevertheless, in the event of an incident, the Government will judge contractors on how they respond to the incident.

In addition to commenting on the requirements and attempting to shape the final draft appropriately, contractors should now consider their ability to comply with the enhanced security requirements of SP 800-171B because successful implementation of these requirements may take time and require the investment of additional resources. Further, a thorough review of future contracts for inclusion of the enhanced security requirements of SP 800-171B must be added to every contractor’s solicitation review, even where contractors do not believe their contracts are likely to involve designated high value assets or critical programs of interest to APTs.

Finally, although DoD has stated that costs of compliance are “allowable costs,” this does not account for commercial item contractors that do not work on a cost reimbursable basis. Those contractors will need to recover these costs in the prices of their goods and services provided to the government.

Public Comment

NIST is seeking public comment on the initial drafts of SP 800-171 Rev. 2, SP 800-171B, and the Cost Estimate, and, due to an extension announced on July 10, 2019, the public comment period will be open until August 2, 2019.  Comments on SP 800-171 Rev. 2 and SP 800-171B can be submitted to NIST via email to sec-cert@nist.gov, while comments on the Cost Estimate can be submitted to the DoD via a Regulations.gov Docket ID DOD-2019-OS-0072. NIST has cautioned that comments on SP 800-171B will be posted without change or redaction to both the Protecting CUI Project and the Regulations.gov Docket ID NIST-2019-0002 and thus, should not include personal or business information commenters do not wish to make public.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Susan B. Cassidy Susan B. Cassidy

Susan Cassidy co-chairs Covington’s Aerospace and Defense Industry Group, and has been advising government contractors for more than 35 years on the requirements imposed on companies contracting with the U.S. Government.

Susan’s practice focuses on the intersection of cybersecurity, national security, and supply…

Susan Cassidy co-chairs Covington’s Aerospace and Defense Industry Group, and has been advising government contractors for more than 35 years on the requirements imposed on companies contracting with the U.S. Government.

Susan’s practice focuses on the intersection of cybersecurity, national security, and supply chain risk management for companies that sell products and services to the U.S. Government. Susan advises contractors at all phases of the procurement cycle, and regularly:

advises clients on compliance obligations imposed by the FAR, DFARS, and other agency regulatory requirements;
leads internal and government False Claims Act (FCA) investigations addressing allegations of violations of government cybersecurity, national security, supply chain, quality, and MIL-SPEC requirements; and
advises clients who have suffered a cyber breach where U.S. government information may have been impacted.

In her work with global, national, and start-up contractors, Susan advises companies on all aspects of government supply chain issues including:

Government cybersecurity requirements, including the Cybersecurity Maturity Model Certification (CMMC), DFARS 252.204-7012, FedRAMP, controlled unclassified information (CUI), and NIST SP 800-171 requirements;
Evolving sourcing issues such as Section 889, counterfeit part requirements, Section 5949 semiconductor product and service restrictions, and limitations on sourcing a variety of products from China; and
Federal Acquisition Security Council (FASC) regulations and product exclusions.

 

Susan previously served as senior in-house counsel for two major defense contractors (Northrop Grumman Corporation and Motorola Incorporated) and is Chambers rated in both Government Contracts and Government Contracts Cybersecurity. Chambers USA has quoted sources stating that “Susan’s in-house experience coupled with her deep understanding of the regulatory requirements is the perfect balance to navigate legal and commercial matters.”

Susan is a former Public Contract Law Procurement Division Co-Chair, former Co-Chair and current Vice-Chair of the ABA PCL Cybersecurity, Privacy and Emerging Technology Committee.

Susan’s pro-bono work extends to assisting veterans in a variety of matters, as well as providing advice to elderly clients on their wills and other end-of-life planning documents.

Read more about Susan B. CassidyEmail
Show more Show less
Photo of Ashden Fein Ashden Fein

Ashden Fein is co-chair of Covington’s Data Privacy and Cybersecurity Practice. He advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance. Ashden also serves as lead counsel…

Ashden Fein is co-chair of Covington’s Data Privacy and Cybersecurity Practice. He advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance. Ashden also serves as lead counsel in criminal, civil, and internal investigations involving cybersecurity, insider risk, and U.S. national security issues.

Ashden regularly counsels clients on preparing for and responding to cyber-based attacks, assessing security controls and practices for the protection of data and systems, developing and implementing cybersecurity risk management and governance programs, and complying with federal and state regulatory requirements. Ashden frequently supports clients as the lead investigator and crisis manager for global cyber and data security incidents, including data breaches involving personal data, advanced persistent threats targeting intellectual property across industries, state-sponsored theft of sensitive U.S. government information, extortion and ransomware, and destructive attacks.

Ashden also assists clients from across industries with leading internal investigations and responding to government inquiries related to U.S. national security and insider risks. He frequently represents government contractors in False Claims Act matters involving cybersecurity and national security. Additionally, he advises aerospace, defense, and intelligence contractors on security compliance under U.S. national security laws and regulations including, among others, the National Industrial Security Program (NISPOM), U.S. government cybersecurity regulations, FedRAMP, and requirements related to supply chain security.

Before joining Covington, Ashden served on active duty in the U.S. Army as a Military Intelligence officer and prosecutor specializing in cybercrime and national security investigations and prosecutions — to include serving as the lead trial lawyer in the prosecution of Private Chelsea (Bradley) Manning for the unlawful disclosure of classified information to Wikileaks. Ashden is a retired U.S. Army officer.

Read more about Ashden FeinEmail
Show more Show less
Photo of Moriah Daugherty Moriah Daugherty

Moriah Daugherty advises clients on a broad range of cybersecurity and national security matters, with a particular focus on risk management and governance, regulatory compliance, incident response and crisis management, and internal and government investigations.

Moriah specializes in counseling clients on a variety…

Moriah Daugherty advises clients on a broad range of cybersecurity and national security matters, with a particular focus on risk management and governance, regulatory compliance, incident response and crisis management, and internal and government investigations.

Moriah specializes in counseling clients on a variety of issues related to cybersecurity risk management and governance, including evaluating security controls, practices, and policies and preparing for cybersecurity incidents and data breaches, including the potential for related investigations, regulatory inquiries, and litigation. She regularly counsels clients on responding to a broad range of cybersecurity incidents, including breaches of personal data and incidents involving extortion and ransomware, targeting and theft of intellectual property by advanced persistent threats, and state-sponsored theft of sensitive U.S. government information.

Drawing on her government experience, Moriah leads cyber-related internal investigations and investigations conducted in response to government inquiries, whistleblower complaints, and threats of litigation, including matters involving allegations of noncompliance with U.S. government cybersecurity regulations and fraud under the False Claims Act.

Prior to becoming a lawyer, Moriah spent eight years working for the Federal Bureau of Investigation and U.S. Department of Justice.

Read more about Moriah DaughertyEmail
Show more Show less