For those DoD DIB contactors and subcontractors the DoD DFARS Q&A updates are worth a read.

← Back to Blog

For those DoD DIB contactors and subcontractors the DoD DFARS Q&A updates are worth a read. DFARS 252.204-7012 addresses ‘Safeguarding covered defense information and cyber incident reporting’ and has been a regulatory requirement since December 2017. Including the protection of CUI hosted by cloud providers.

Q&A 115 should be noted – Page 73. (https://lnkd.in/eNvdRhja)

Q115:‚ ‚ The‚ DFARS states‚ the‚ Contractor‚ shall‚ require‚ and‚ ensure‚ that the‚ cloud‚ service provider‚ meets‚ security‚ requirements equivalent to those established by‚ the‚ Government‚ for the‚ Federal‚ Risk‚ and Authorization Management Program‚ (FedRAMP)‚ Moderate‚ baseline.‚ ‚ If the‚ cloud‚ provider‚ is‚ not‚ FedRAMP‚ certified,‚ how can‚ a‚ contractor ensure that‚ the cloud provider meets security requirements equivalent to‚ FedRAMP‚ Moderate?

For CUI, the application of FedRAMP Moderate is recommended as a baseline to protect CUI. How will this apply to defence contractors outside of the US. If reciprocity of cyber standards and their application is required, will local cloud providers be able to provide FedRAMP equivalent cloud storage for DoD CUI created, processed or stored for international DIB contractors.

Ted Dziekanowski Jason Spezzano Brian McCarthy

#theaugustagroup‚ #theaugustaplan‚ #cybersecurity‚ #supplychainriskmanagement‚ #cyberriskmanagement‚ #compliance‚ #regulatorycompliance‚ #regulatoryoversight‚ #esg‚ #scrm‚ #cscrm‚ #cybercompliance‚ #cyberregulation‚ #cybergovernance‚ #digitalcurrency‚ #sec‚ #cyberriskgovernance‚ #dhs‚ #securitiesandexchangecommission‚ #ransomeware‚ #csfprofiles‚ #dhs‚ #cisa‚ #governance‚ #nist‚ #nist800171‚ #nist80053 #cui #fedramp #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6878621705632309248