Why Computers Aren’t As Bad As You Think
Overview of Government Contractor Cyber Security Compliance
Cybersecurity has become a crucial requirement for government contractors in 21st century operations. Security threats have become so real and strong that all computer systems can be considered vulnerable to attacks, whether the hacker is located on the other side of the world, or in the same room as the computer. While this has been an issue for a long time for all Internet users, government contractors now have the special regulatory obligation of employing cybersecurity measures, without diminishing their ability to fulfill their responsibilities as government contractors.
New cybersecurity rules for government contractors are set to take effect on December 31, 2017. To be affected by these are the Department of Defense (DOD), the General Services Administration (GSA) and the National Aeronautics and Space Administration (NASA).
With cybersecurity standards and practices already well-established for classified projects, the new set of regulations will be intended to protect unclassified sensitive information. This is to address the problem of security breaches becoming increasingly common since the last few years.
The new cybersecurity rules were first issued two years ago, but some government contractors have not seriously acted on them and may not be fully aware of the requirements. As per a hundred new regulations, NASA, DOD and GSA contractors must enforce tougher physical security measures at their physical premises, enforce and document cybersecurity guidelines and practices, and build a comprehensive emergency plan that will protect them against a cybersecurity attack.
Compliance with the new cybersecurity regulations will cost differently for various companies. There are contractors who only have to make small adjustments to their current cybersecurity practices and policies, while others may have to spend so much more to update or replace old servers, buy new equipment or hire security experts.
While some government contractors are well-prepared for the new set of regulations, many are not. The regulates require a new range of compliance obligations. But the not-so-known risks to government contractors, like the potential for litigation or subcontractor-related compliance issues, can pose bigger risks for them as time goes by. Therefore, it is a must that government contractors work regularly with their lawyer, with cyber professionals and with compliance officers to avoid any problems.
In 2017, federal officials promoted more effective cybersecurity by announcing different regulatory actions. For example, in February, the federal government announced a “Cybersecurity National Action Plan,” along with two subsequent related executive orders.
In October of the same year, the Department of Defense issued a final rule that implemented cyber incident reporting requirements for all DOD contractors and subcontractors. DOD is calling on its contractors to be part of a voluntary Defense Industrial Base cybersecurity information sharing program, where they can exchange vital cybersecurity information with other contractors and learn from one another.