Tag: Regulatory Compliance and Ethics

NISPOM Conforming Change 2: What You Need to Know

Justin A. Chiarodo and Philip Beshara

Justin A. Chiarodo CC2030E479B404E304DCCE7B55CFAC26The government recently issued long-awaited amendments to the National Industrial Security Program Operating Manual (“NISPOM”).  The amendments, known as Conforming Change 2, are targeted at combating insider threats and impose several new requirements warranting immediate action by contractors holding facility clearances.

There are four key elements to Change 2: (1) a mandated Insider Threat Program (“ITP”); (2) new cyber incident reporting requirements; (3) newly defined NISPOM components; and, (4) an updated standard for foreign-owned or controlled companies seeking access to proscribed information.  We summarized these changes and provide implementation suggestions below.

I. Insider Threat – Mandated Insider Threat Program

Change 2 requires cleared contractors to have a written Insider Threat Program plan no later than November 30, 2016.  The ITP must detect, deter, and mitigate insider threats consistent with the ITP requirements currently imposed on executive branch agencies (as set forth in Executive Order 13587 and the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs). Continue reading “NISPOM Conforming Change 2: What You Need to Know”

Coming to a Government Contract Near You: Mandatory Information Safeguarding Requirements

Justin A. Chiarodo,  Philip E. Beshara, and Heather L. Petrovich

The government recently finalized a sweeping amendment to the Federal Acquisition Regulation (“FAR”) that will impose basic information system safeguarding requirements on many federal acquisitions, marking the latest in the continuing government effort to regulate and enhance cybersecurity protections in the industry. The Final Rule, effective June 15, 2016, imposes fifteen basic safeguarding requirements for contractors with information systems containing information provided by, or generated for, the government under a federal contract.

Though many contractors likely maintain information security standards that meet or exceed the new rule, they should confirm their compliance status by assessing these requirements against their current cybersecurity compliance program (to help mitigate the risk of a breach of contract claim or more serious enforcement action). This should include confirming that the requirement is flowed down to subcontractors where appropriate. Continue reading “Coming to a Government Contract Near You: Mandatory Information Safeguarding Requirements”