DFARS Compliance Consulting

Basic Security Requirements

• Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
• Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Derived Security Requirements

• Control the flow of CUI in accordance with approved authorizations.
• Separate duties of individuals to reduce the risk of malevolent activity without collusion.
• Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Basic Security Requirements

• Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.
• Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

Derived Security Requirements

• Provide audit reduction and report generation to support on-demand analysis and reporting.
• Protect audit information and audit tools from unauthorized access, modification, and deletion.
• Limit management of audit functionality to a subset of privileged users.

Basic Security Requirements

• Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organizational information systems.
• Ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Derived Security Requirements

• Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Basic Security Requirements

• Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
• Establish and enforce security configuration settings for information technology products employed in organizational information systems.

Derived Security Requirements

• Track, review, approve/disapprove, and audit changes to information systems.
• Analyze the security impact of changes prior to implementation.
• Control and monitor user-installed software.

Basic Security Requirements

• Identify information system users, processes acting on behalf of users, or devices.
• Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Derived Security Requirements

• Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
• Prevent reuse of identifiers for a defined period.
• Store and transmit only encrypted representation of passwords.

Basic Security Requirements

• Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.
• Track, document, and report incidents to appropriate officials and/or authorities both internal and external to the organization.

Derived Security Requirements

• Test the organizational incident response capability.

Basic Security Requirements

• Perform maintenance on organizational information systems.
• Provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

Derived Security Requirements

• Ensure equipment removed for off-site maintenance is sanitized of any CUI.
• Check media containing diagnostic and test programs for malicious code before the media are used in the information system.
• Supervise the maintenance activities of maintenance personnel without required access authorization.

Basic Security Requirements

• Protect (i.e., physically control and securely store) information system media containing CUI, both paper and digital.
• Limit access to CUI on information system media to authorized users.

Derived Security Requirements

• Mark media with necessary CUI markings and distribution limitations.
• Control the use of removable media on information system components.
• Protect the confidentiality of backup CUI at storage locations.

Basic Security Requirements

• Screen individuals prior to authorizing access to information systems containing CUI.
• Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Basic Security Requirements

• Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
• Protect and monitor the physical facility and support infrastructure for those information systems.

Derived Security Requirements

• Escort visitors and monitor visitor activity.
• Maintain audit logs of physical access.
• Enforce safeguarding measures for CUI at alternate work sites (e.g., telework sites).

Basic Security Requirements

• Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of CUI.

Derived Security Requirements

• Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting the system are identified.
• Remediate vulnerabilities in accordance with assessments of risk.

Basic Security Requirements

• Periodically assess the security controls in organizational information systems to determine if the controls are effective in their application.
• Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems.

Basic Security Requirements

• Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
• Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational information systems.

Derived Security Requirements

• Separate user functionality from information system management functionality.
• Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
• Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Basic Security Requirements

• Identify, report, and correct information and information system flaws in a timely manner.
• Monitor information system security alerts and advisories and take appropriate actions in response.

Derived Security Requirements

• Update malicious code protection mechanisms when new releases are available.
• Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
• Identify unauthorized use of the information system.

With DFARS’ extensive technical, organizational, and physical security requirements, establishing compliance is not easy. Defense contractors must ensure that they have a comprehensive understanding of their obligations, and they must commit themselves to doing what is necessary to comply. For defense contractors that are not DFARS-compliant, implementing an effective compliance program starts with conducting an in-depth assessment of their current security protocols and seeing how they stack up against the DFARS requirements.

While all defense contractors need to implement custom DFARS compliance programs, the core components of most contractors’ programs will be similar. These include comprehensive compliance documentation, DFARS compliance program implementation and training, compliance monitoring and auditing, and compliance enforcement.

While all defense contractors are generally subject to the same DFARS requirements, the steps contractors must take to meet these requirements will vary based on their size and financial resources. As a result, what is required of one defense contractor will not necessarily be required of another, and what is sufficient for one contractor might be insufficient for its larger competitors.

The risks of DFARS noncompliance can be substantial. Defense contractors found in noncompliance can lose their contracts with the DOD, and individuals who are responsible for a contractor’s compliance failures can potentially face civil or criminal penalties. If a compliance failure leads to an intrusion that threatens national security, the consequences can be far more severe.

Because of the complexity and challenges of DFARS compliance, most defense contractors will need to engage an outside consulting firm to assist them. With our consultants’ prior experience at the DOD OIG and other federal agencies and offices (including the DOJ and FBI), we are uniquely positioned to help our clients meet their obligations under DFARS.