Getting Started with DFARS 7012

Learn the basics about CDI and NIST 800-171 and how the compliance requirements may impact your DoD business.
WHAT IS CDI?

CDI, or Covered Defense Information, means unclassified controlled technical information or other information that requires safeguarding or dissemination controls. CDI is either marked (or otherwise identified) or developed/received in support of a contract. The complete definition is in the language of the DFARS 7012 clause.

WHO DECIDES WHAT IS CDI?

The government’s contracting officer has the responsibility for determining what data is and isn’t CDI.

HOW DO I PROTECT CDI?
  • Implement NIST SP 800-171 requirements by 12/31/2017
  • Follow DFARS 7012 (b)-(f)
WHAT IS NIST SP 800-171?

NIST SP 800-171 is the National Institute of Standards & Technology (NIST) document providing 110 recommended security requirements for protecting the confidentiality of CUI (Controlled Unclassified Information – a subset of CDI).

The DFARS 7012 clause says that you shall implement NIST SP 800-171 no later than Dec 31, 2017.  Since the deadline has passed, you are now at risk of non-compliance if you have not implemented the requirements.  The government will now apply a risk-based approach to awarding contracts that include handling of CDI.

WHAT DO YOU HAVE TO DO?
  1. Understand what information you need to protect
  2. Conduct an assessment to identify compliance gaps
  3. Provide adequate security controls to protect CDI
  4. Create an incident response plan
  5. Train your employees
  6. Institute continuous monitoring and improvement

Click Here to download the “DFARS 7012 Compliance in 6 Steps” Infographic.

Need to get compliant fast?  Learn more about our DFARS as a Service Program.

WHERE ARE THESE REQUIREMENTS APPLIED?

On any system where you store, process, or access CDI.

WHEN IS COMPLIANCE DUE?

The December 31, 2017 deadline has passed; all CDI must now be safeguarded. If you handle CDI but are not yet fully compliant, it is urgent to complete your implementation of all 110 security controls of NIST 800-171 plus additional DFARS requirements as soon as possible.