Search for: Cybersecurity for Suppliers THE NEED FOR CYBERSECURITY THROUGHOUT OUR SUPPLY CHAIN The threats facing industry’s ability to adequately safeguard its critical infrastructure are escalating dramatically. Hacking tools that require little or no skill to execute are increasingly available online, lowering the barrier of entry for bad actors and increasing their capabilities. Cybersecurity attacks are complex and often go undetected. Additionally, DoD policy states that “cybersecurity be fully considered and implemented in all aspects of acquisition programs across the life cycle and responsibility for cybersecurity extends to all members of the acquisition workforce.” General Dynamics Mission Systems is committed to a proactive and compliant cybersecurity approach to safeguarding our networks, information, and systems. Below are resources for our suppliers on federal regulations and how to report cybersecurity incidents. REGULATORY REFERENCES Federal Acquisition Regulation (FAR): FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems This clause is applicable to all solicitations and contracts when a contractor or subcontractor at any tier may have federal contract information residing in or transiting through its information systems, including commercial items other than commercially available off-the-shelf items (COTS). Synopsis: Requires basic safeguarding requirements and procedures to protect covered contractor information systems Imposes 15 categories of security controls focused on safeguarding contractor systems that process, store or transmit Federal contract information Although not specifically stated, contractors in compliance with the more expansive NIST SP 800-171 security controls will presumably be in compliance with the FAR requirements Applicable to all solicitations and contracts when a contractor or subcontract at any tier may have federal contract information residing in or transiting through its information systems. Does not apply to contracts or subcontracts for COTS. Defense Federal Acquisition Regulation Supplement (DFARS): DFARS Prescription 252.204-7008 Compliance with Safeguarding Covered Defense Information All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items 252.204-7009 Limitation on the Use or Disclosure of Third Party Contractor Reported Cyber Incident Information All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, for services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, except for solicitations and contracts solely for the acquisition of COTS items 252.239-7009 Representation of Use of Cloud Computing All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial item, for information technology services 252.239-7010 Cloud Computing Services All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial item, for information technology services NIST SP 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal information systems and organizations. Generally, Department of Defense contractors, except COTS suppliers, are required to implement these security requirements by no later than December 31, 2017. Please refer to DFARS 252.204-7008, DFARS 252.204-7012 and NIST SP 800-171 for more details. FLOW-DOWN CLAUSES TO GENERAL DYNAMICS SUPPLIERS The applicable flow-down clauses are included in General Dynamics Mission Systems terms and conditions for its suppliers. Our terms and conditions are available at the following link: https://gdmissionsystems.com/suppliers/terms-conditions/ REPORTING A CYBERSECURITY INCIDENT In accordance with DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting, subcontractors, including vendors and consultants, are required to rapidly report cyber incidents within 72 hours of discovery to the GDMS Buyer point of contact, the GDMS Security Operations Center hotline at (210) 638-7050, and directly to Department of Defense (DoD) at https://dibnet.dod.mil/portal/intranet/. This includes providing the incident report number, automatically assigned by DoD to General Dynamics Mission Systems as soon as practical. DEPARTMENT OF DEFENSE (DOD) CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) AND NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS Overview CMMC is a DoD certification process to measure a company’s ability to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC combines cybersecurity standards and maps these best practices and processes to maturity levels, from basic cyber hygiene to advanced/progressive. All DoD contractors and subcontractors with access to FCI or CUI will have their cyber acumen scored on a scale of 1 to 5. The Department of Defense will use the same scale to stipulate in solicitations the CMMC level required. Companies that solely produce Commercial-Off-The-Shelf (COTS) products do not require a CMMC certification. A CMMC Accreditation Body -- a neutral third party that will maintain the standard for DoD –- was established to train and verify third-party cybersecurity certifiers who will conduct audits. Additional information regarding the CMMC Accreditation Body is available at https://www.cmmcab.org/. All contractors and subcontractors with access to FCI or CUI must have a current DoD Assessment score in the DoD Supplier Performance Risk System (SPRS) for all CAGE codes covered by your System Security Plan (SSP). Refer to COMPLIANCE WITH DFARS 252.204-7020 NIST SP 800-171 DoD ASSESSMENT REQUIREMENTS for additional information. Additional information regarding DoD’s CMMC is available at: Department of Defense CMMC Information Supplier Impact Certification of cybersecurity compliance will be required for suppliers to do business with General Dynamics Mission Systems and the U.S. DoD, unless the supplier solely provides COTS. Certification of cybersecurity compliance is led by the Office of Under Secretary of Defense for Acquisition and Sustainment, and CMMC scores will be tracked by the DoD. Again, all companies will require a CMMC rating from 1 to 5 (except COTS suppliers), and DoD solicitations may restrict the use of suppliers below a specified CMMC level. In order for a supplier to process, store or transmit CUI, it must be certified at least at CMMC level 3. Suppliers will be responsible for sourcing, conducting and reporting their CMMC audits via accredited third-party entities. The CMMC Accreditation Body is developing the process for certifications. Refer to the “Organizations Seeking Certification” section of the CMMC Accreditation Body site for additional information: https://www.cmmcab.org/contractors. For more information on CMMC, as well as other DoD cybersecurity initiatives, Project Spectrum is a recommended resource (https://projectspectrum.io). Project Spectrum is supported by the DoD Office of Small Business Programs, and provides information, training, and risk assessments to help vendors improve cyber readiness and comply with DoD requirements. Additionally, the Procurement Technical Assistance Centers (PTACs) provide vendors free assistance, including assistance related to DoD cybersecurity initiatives, to help them pursue contracts from DLA and other federal agencies. For more information refer to - https://www.dla.mil/SmallBusiness/PTAP/. Additional Information https://www.dla.mil/SmallBusiness/PTAP/PTAC/ https://www.dau.edu/ https://www.dla.mil/SmallBusiness/PTAP/PTAC/ https://www.dau.edu/ https://www.cmmcab.org/ https://www.acq.osd.mil/cmmc/index.html Defense Industrial Base (DIB) Sector Coordinating Council (SCC) launched a new CyberAssist Website. ACHIEVING CYBERSECURITY COMPLIANCE – OTHER HELPFUL CYBERSECURITY REFERENCES: CISA: Stop Ransomware Site Department of Defense (DoD): DoD: Small Business Cybersecurity DoD Procurement Toolbox Defense Cybersecurity Requirements: What Small Businesses Need to Know [PDF] Network Penetration Reporting and Contracting for Cloud Services (2013-D018) Cybersecurity Challenges - Protecting DoD’s Unclassified Information (Industry Information Day, June 23, 2017) Cybersecurity Maturity Model Certification Department of Homeland Security (DHS): DHS: Cybersecurity US-Cert: Resources for Small and Midsize Businesses (SMB) DHS: Stop.Think.Connect. Campaign Cyber Resilience Review (CRR) Defense Information Systems Agency (DISA): DISA: Cybersecurity Federal Bureau of Investigation (FBI): Federal Bureau of Investigation (FBI) Website Federal Communications Commission (FCC): FCC Cyberplanner FCC: Cybersecurity for Small Business Federal Trade Commission (FTC): Articles About Basic Small Business Security Practices General Services Administration (GSA): GSA: Cybersecurity National Archives Information Security Oversight Office Information Security Oversight Office (ISOO) ISOO – CUI Briefing – January 27, 2017 [Video] National Institute of Standards and Technology: NIST: Cybersecurity Framework NIST: Commission on Enhancing National Cybersecurity NIST: Computer Security Resource Center NIST: CUI Plan of Action Template NIST: CUI SSP Template Small Business Administration: SBA: Cybersecurity SBA: Self Paced Training CONTACT US MAJOR LOCATIONS FAQ EMPLOYEES GENERAL DYNAMICS UK GENERAL DYNAMICS MISSION SYSTEMS—CANADA GENERAL DYNAMICS MISSION SYSTEMS—ITALY GENERAL DYNAMICS MISSION SYSTEMS—AUSTRALIA GPS SOURCE CONTRACT VEHICLES DISCONTINUED PRODUCTS SUPPLIERS VIEW ALL PRODUCTS, PROGRAMS & SERVICES CAREERS AT MISSION SYSTEMS SEARCH FOR OPEN POSITIONS ENTRY LEVEL & INTERN POSITIONS CLEARED POSITIONS Copyright 2021 General Dynamics Mission Systems, Inc. Site Terms Of Use Privacy Policy EU General Data Protection Regulation Federal Employee Notices A GENERAL DYNAMICS BUSINESS GD.COM We use cookies to enhance your website experience. By continuing to visit this site, you agree to our use of cookies. Learn More