Source: https://www.federalregister.gov/documents/2016/05/16/2016-11001/federal-acquisition-regulation-basic-safeguarding-of-contractor-information-systems
Timestamp: 2017-06-24 10:38:20
Document Index: 240542396

Matched Legal Cases: ['art1', 'arts 4', 'art2', 'art 4', 'art3', 'art4', 'art5', 'art7']

30439-30447
SUPPLEMENTARY INFORMATION:Start Printed Page 30440
https://www.federalregister.gov/d/2016-11001
Ms. Cecelia L. Davis, Procurement Analyst, at 202-219-0202, for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at 202-501-4755. Please cite FAC 2005-88, FAR Case 2011-020.
Revises the title of the case and throughout the final rule to add the term “covered” to “contractor information system,” thus indicating that the policy applies only to contractor information systems that contain Federal contract information.
Adds definitions of “covered contractor information system” and “Federal contract information.”
Deletes definitions of “public information” and all other proposed definitions in the clause, except “information,” “information system,” and “safeguarding.”
Makes the final rule—
Comments: About half the respondents commented on the scope and applicability of the proposed rule, which required safeguarding of information provided by or generated for the Government (other than public information). The proposed rule included the statutory definition of “public information” from 44 U.S.C. 3502. The respondents generally commented on the breadth of the scope or a lack of clarity.
Several respondents were also concerned about the broad potential scope of the information subject to these requirements. One respondent stated that the rule would cover nearly all information and all information systems of any company that holds even a single Government contract. One respondent questioned whether “generated for the Government” just applied to information that is part of a contract deliverable, or whether it also covered information about the contractor's own proprietary practices that is submitted to the Government. Another respondent was concerned that agencies have tended to broadly expand FISMA requirements to information developed under Federal contracts, regardless of whether the information is a deliverable under the contract (e.g., data exchanged among researchers). One respondent recommended limiting the covered Start Printed Page 30441information to “information provided by or delivered to the Government.” Another respondent urged narrowing the rule to the type of information for which safeguards are warranted, based on a reasoned risk assessment and cost-benefit analysis. One respondent recommended that the rule should exclude contractor proprietary or trade secret data from the scope of information generated for the Government, so that the responsibility for protecting such information remains with the contractor.
Further, respondents were concerned about interpretation of the definition of “public information.” Several respondents considered that the definition of “public information” was too narrow, because it requires the actual disclosure, dissemination, or disposition of information. One respondent stated that the Government has significant volumes of data that have not yet been made public, but that may be subject to obligations for disclosure under a variety of statutes. Several respondents stated that contractors cannot readily determine what information is categorized as public information, because it is almost impossible for contractors to keep track of what information has been released to the public.
Response: The intent is that the scope and applicability of this rule be very broad, because this rule requires only the most basic level of safeguarding. However, applicability of the final rule is limited to covered contractor information systems, i.e., systems that are owned or operated by a contractor that process, store, or transmit Federal contract information. “Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments. The final rule has been coordinated with NARA. The focus of the final rule is shifted from the safeguarding of specific information to the basic safeguarding of certain contractor information systems. Therefore, it is not necessary to draw a fine line as to what information was “generated for the Government,” when the information is received, or whether the information is marked. The requirements pertain to the information system itself. The type of analysis required to narrow the rule to the type of information for which safeguards are warranted, based on risk-assessment and cost-benefit analysis, is appropriate for CUI and the enhanced safeguarding that would be required for such information consistent with law, Federal regulation, and Governmentwide policy. A prudent business person would employ this most basic level of safeguarding, even if not covered by this rule. This rule is intended to provide a basic set of protections for all Federal contract information, upon which other rules, such as a forthcoming FAR rule to protect CUI, may build.
The definition of “public information” has been deleted, as it is no longer necessary.
Comment: One respondent requested clarification of the statutory definition of “information system,” i.e., what would be the limitation for a system interfacing with another system. The respondent requested that the rule specifically identify the medium of communication, the mechanism for delivering the communication, and the disposition.
Comment: Another respondent requested a definition of “resides on or transits through” an information system. The respondent is concerned that much of the focus of information security efforts is directed at protecting perimeter devices and may overlook the necessity of protecting the host servers.
Response: Information “residing on” a system means information being processed by or stored on the information system. “Transiting through” the system means simple transport of the data through the system to another destination (i.e., no local storage or processing). All of the controls listed are focused on protection of the information system (e.g., the host servers, workstations, routers). None of the controls are devoted to protection of “perimeter devices” although several (particularly paragraphs (b)(1)(x) and (xi)) are applied at the perimeter of the system.
Response: This was not the intent of the proposed rule. The final rule has revised the applicability section to address “acquisitions” rather than “solicitations and contracts.” Of course, the clause prescription still requires inclusion of the clause in solicitations, so that offerors are aware of the clause that will be included in the resultant contract. The clause does not take effect until the offeror is awarded a contract containing the clause.
Comment: Two respondents requested exclusion of contracts for fundamental research from the requirements of the rule. One respondent noted that the prior proposed DFARS rule included an exception for solicitations and contracts for fundamental research, while also noting that most of the respondent's member institutions have at least first level information technology security measures in place within their systems, which appear to meet most of the basic safeguarding requirements. Another respondent, while recognizing that some level of protection should be afforded, seeks regulations that will provide an appropriate level of protection without creating unwieldy compliance burdens or creating a chilling effect on academic Start Printed Page 30442activity, including fundamental research.
Another respondent noted that Federal agencies are required to adhere to information security standards and guidelines published by NIST in Federal Information Processing Standards (FIPS) and Special Publications (SP). These publications explicitly state that the same standards apply to outsourced external service providers. Agencies and their contractors are also required to implement the configuration control settings at a “bits and bytes” level contained in the security configuration control checklists found in the National Security Program (NSP), which is co-hosted by NIST and the Department of Homeland Security (DHS).
Comment: Another respondent recommended that the Councils should consider adopting a performance standard for protecting specific types of information from unauthorized disclosure rather than the “design standard” in the proposed rule.
Comment: One respondent requested clarification of the meaning of “safeguarding.” According to the respondent, the definition of “safeguarding” neither refers to nor incorporates the definition of “information security.” The respondent questions whether the rule intends to distinguish between information security and safeguarding.
Response: There is a basic distinction between “safeguarding” and “information security.” “Safeguarding” is a verb and expresses required action and purpose. The term “safeguarding” is common in Executive orders relating to information systems. Although safeguarding has some commonality with “information security” the focus of information security is narrower. Safeguarding the contractor's information system will promote confidentiality and integrity of data, but is not specifically concerned with data availability.
Comment: One respondent recommended that the rule should just require the contractor to protect information provided to or generated for the Government “at a level no less than what the company provides for its own confidential and proprietary business information.”
Comment: One respondent commented on the requirement in the proposed rule (FAR 52.204-21(b)(1)) to protect information on public computers or Web sites. The respondent recommended focusing on covered contractor information systems. If retaining the term “public computers,” the respondent recommended defining the term, taking into consideration that some contractors have a contractual obligation to use “public computers” in performance of a contract, and removing the restriction on the use of public computers if the use has implemented a secure means of accessing the covered Government information.
Response: The heading in the proposed rule in FAR paragraph 52.204-21(b)(1), “Protecting information on public computers or Web sites,” misstated the intent of the requirement. The requirement was to not process information provided by the Government on public computers or Web sites. In the final rule, this heading has been removed and the requirement has been restated to be consistent with NIST 800-171.
Comment: Many respondents commented on the requirement in the proposed rule (FAR 52.204-21(b)(2)) regarding transmitting electronic information. The primary concern of all of these respondents was the requirement for “the best level of security and privacy available given facilities, conditions, and environment.” As one respondent stated, this is not consistent with the objective of the rule to require basic safeguarding, is not a defined term of art, and may not be consistent with the cost-effective standards and risk-based approach established by FISMA. Another respondent noted that requiring contractors to use the best level for all data, would prevent businesses from upgrading communications security for the transmission of more sensitive data. Another respondent pointed out that changes in technology would cause frequent changes in what would constitute the “best level.” One respondent recommended replacing Start Printed Page 30443“best” with “adequate,” or “commercially reasonable.”
Comment: More than half the respondents commented on the requirement in the proposed rule (FAR 52.204-21(b)(3)) relating to transmitting voice and fax information. A primary concern of respondents was the requirement that covered information can be transmitted orally only when the sender has “reasonable assurance” that access is limited to authorized recipients. The respondents found this requirement to be too vague. According to one respondent, there is further concern that the term “voice information” could arguably apply to any oral communication, such as telephone conversations. One respondent recommended the adoption of strict, clear policies in securing the voice communications of contractor systems, including encryption requirements for all transmissions. One respondent questioned whether the rule covered voice communication over CDMA [code-division multiple access], GSM [Global System for Mobile], and VOIP [voice-over-Internet-Protocol], or some combination of the three.
Response: After evaluation of public comments, the requirement regarding transmission by phone and fax are outside the scope of the final rule, which deals with safeguards for the contractor's information system not protection of information.
Comment: Several respondents commented on the requirement in the proposed rule (FAR 52.204-21(b)(4)) regarding physical and electronic barriers to protect Federal contract information. There was general concern that for certain devices it would not be practicable to always have both a physical barrier and an electronic barrier, when not under direct individual control. One respondent was concerned that NIST does not mention the specific types of locks or keys that will provide acceptable protection. Another respondent questioned what “direct individual control” means. Another respondent was concerned about the potential need to protect the information itself, when in hard copy. One respondent considered that this requirement may philosophically conflict with Government and commercial efforts to create and accommodate a mobile workforce.
Detecting, reporting, and responding to security incidents. One respondent stated that under FISMA it is mandatory for contractors to report security incidents to law enforcement if Federal contract information is resident on or passing through the contractor information system. This respondent also expressed concern about how personally identifiable information (PII) notifications would be properly made, without reporting requirements.Start Printed Page 30444
Response: This rule establishes minimum standards for contractors' information systems that process, store, or transmit Federal contract information where the sensitivity/impact level of the Federal contract information being protected does not warrant a level of protection necessitating training, penetration or vulnerability testing, evaluation, and reporting, detecting, reporting, and responding to security incidents, encryption at rest, or cybersecurity insurance. Such standards would be needed if contract performance involved the contractor accessing CUI or classified Federal information systems. The final rule under DFARS Case 2011-D039, retitled “Safeguarding Unclassified Controlled Technical Information” (published in the Federal Register at 78 FR 69273 on November 18, 2013), provided for enhanced levels of safeguarding because that case addressed a more sensitive level of information. Requiring cybersecurity insurance is outside the scope of this case.
Comment: One respondent commented on the requirement in the proposed rule (FAR 42.302(a)(21)) regarding the contract administration function to “ensure that the contractor has protective measures in place, consistent with the requirements of the clause at 52.204-21.” The respondent noted that the term “protective measures” was not used in the clause.
Response: This requirement has been deleted from the final rule.
Some respondents were concerned that the lack of clarity imposes significant risks of disputes, and increases costs, since a contractor must design to the most stringent standard in an attempt to assure compliance. For example, several respondents were concerned that the potentially broad definition of “information” would significantly increase the compliance burden for contractors. Another respondent noted that the vagueness Start Printed Page 30445and subjective nature of some of the requirements (e.g., “best available” standard at 52.204-21(b)(2)) would place an incredible financial burden on businesses, creating an inequitable burden upon many small businesses.
This action is being implemented to revise the Federal Acquisition Regulation (FAR) to safeguard contractor information systems that process, store, or transmit Federal contract information. The objective of this rule is to require contractors to employ basic security measures, as identified in the clause, for any covered contractor information system.
Start Amendment Part1. The authority citation for 48 CFR parts 4, 7, 12, and 52 continues to read as follows:End Amendment Part
Start Amendment Part2. Add subpart 4.19 to read as follows: End Amendment Part
Start Amendment Part3. Amend section 7.105 by revising paragraph (b)(18) to read as follows: End Amendment Part
Start Amendment Part4. Amend section 12.301 by redesignating paragraphs (d)(3) through (7) as paragraphs (d)(4) through (8) and adding a new paragraph (d)(3) to read as follows: End Amendment Part
Start Amendment Part5. Add section 52.204-21 to read as follows: End Amendment Part
Start Amendment Parta. Revising the date of the clause and paragraph (a)(2)(viii); End Amendment Part
Start Amendment Partb. Redesignating paragraphs (b)(2)(i) through (iv) as paragraphs (b)(2)(ii) through (v); and End Amendment Part
Start Amendment Partc. Adding a new paragraph (b)(2)(i). End Amendment Part
( b) * * *
Start Amendment Part7. Amend section 52.244-6 by— End Amendment Part
Start Amendment Parta. Revising the date of the clause and in paragraph (a) the definition “Commercial item”; End Amendment Part
Start Amendment Partb. Redesignating paragraphs (c)(1)(iii) through (xiv) as paragraphs (c)(1)(iv) through (xv); and End Amendment Part
Start Amendment Partc. Adding a new paragraph (c)(1)(iii). End Amendment Part