On March 12, 2024, the Department of Defense (DoD) published a final rule, revising the eligibility criteria for the voluntary DoD Defense Industrial Base (DIB) Cybersecurity (CS) Activities Program.  The intent of the rule is to permit all defense contractors that own or operate unclassified information systems that process, store, or transmit covered defense information to participate in the program.  Previously, only cleared contractors were permitted to participate in the sharing of this information.  The final rule also amends identity proofing requirements by eliminating the need to obtain a medium security certificate to participate in either the voluntary or mandatory reporting regimes.  The rule will take effect on April 11, 2024, and DoD anticipates a significant increase in contractor participation.

Additional information about the rule is outlined below.

Goals of the Program

The DIB CS Program aims to support contractor safeguarding of defense information by promoting the sharing of threat and mitigation strategies across Program participants.  The Program is intended to encourage the sharing of threat information to complement the mandatory obligations imposed on contractors through DFARS 252.204–7012.  Specific goals include establishing a broader voluntary framework for protecting confidential information and collectively working to maximize cybersecurity through cyber threat information sharing, expanded incident reporting, and mitigation strategy and malware analysis dissemination.  Contractors can benefit from the Program by receiving training, best practices, and Government Furnished Information.  Participants can also access the online platform, DIBNet, and the DoD Cyber Crime Center (DC3), which provide resources and enable threat information sharing across participants.

History of the Program

The DIB CS Program began as an interim 2012 rule that initially applied only to contractors who had the ability to safeguard classified information and were cleared with a facility security clearance to at least the Secret level.  In 2015, the Program expanded to include all cleared contractors – not just those with the ability to safeguard classified information.  The final rule notes that DoD has seen a steady increase in the percentage of defense contractors that are interested in participating but could not because they do not meet the eligibility requirements.  The 2024 update reaches more broadly, effectively expanding eligibility to all contractors covered under DoD’s mandatory reporting requirements.  This expansion also recognizes the increased reliance of DoD on commercial products in its supply chain and the need to provide those commercial contractors with the information they need to protect their systems and the products they provide to the Government.  Similarly, the expansion recognizes that smaller defense contractors (which were less likely to meet eligibility requirements) have fewer resources overall to devote to cybersecurity, and therefore may benefit from the information that is shared in the program.

Key Updates to the Final Rule

Due to increased interest in the Program, industry feedback to engage a broader cross-section of the community, and DoD’s desire to deliver increasingly tailored threat information, the updated rule expands eligibility and seeks to reduce the burden on contractors to participate.  First, DoD eliminated the prior requirement that participants maintain an existing active facility clearance to at least the Secret level.  (Contractors must still have the ability to safeguard classified information to receive any classified threat information electronically.)  The updated rule applies to any contractor that owns or operates a covered contractor information system (including those who handle unclassified information).  

Second, contractors no longer must obtain a medium assurance certificate and pay an associated fee to qualify for the Program.  Instead, in an effort to reduce the burden on contractors, the rule allows contractors to register with Procurement Integrated Enterprise Environment (PIEE) to meet identity proofing requirements for both the voluntary and mandatory reporting programs.  Allowing the use of  PIEE to meet identity proofing requirements is helpful because all DoD contracts already include a requirement to register with PIEE to receive electronic payments. 

Third, DoD also clarified that a contractor may authorize a third-party service provider to report incidents on behalf of the contractor through a DIB CS Program Framework Agreement.  

What does this Mean for Contractors?

DoD anticipates that updates to the final rule will increase Program eligibility by an estimated 68,000 defense contractors, and approximately 8,000 more contractors will apply based on past participation statistics.  Contractors should benefit from this updated, final rule if they choose to participate through easier entry into the Program and more participants sharing information on cyber threats and mitigation strategies.  Faced with evolving and more sophisticated threat actors, DoD hopes to benefit from increased awareness and improved assessments of cyber incidents with data from a broader set of contractors and industries.