This briefing covers active market intelligence, regulatory guidelines, and tactical capture recommendations for federal and defense contractors pursuing opportunities in this procurement classification.
Government contractors performing classified contracts have long been subject to cybersecurity requirements.1 However, developments over the past several months indicate that a much broader group of Federal Government contractors may soon face significant new cybersecurity requirements intended to establish a more uniform approach to safeguarding controlled unclassified information (CUI).
Controlled Unclassified Information
Not all information protected from public disclosure by the federal government is classified. Unclassified information may be protected from public disclosure if it is proprietary, subject to export controls, or otherwise exempt from disclosure by law, regulation, or policy. This type of protected information is referred to as controlled unclassified information (CUI). Historically, each federal agency developed and promulgated policies, standards and procedures for marking and safeguarding CUI.
Executive Order 13556
On November 4, 2010, President Obama signed Executive Order 13556, “Controlled Unclassified Information” (E.O. 13556).2 E.O. 13556 notes that the patchwork of agency-specific policies for safeguarding CUI has proved inefficient and created impediments to authorized sharing of CUI information. To remedy this situation, E.O. 13556 contemplates the creation of a CUI program that emphasizes government-wide openness and uniformity. E.O. 13556 identified the National Archives and Record Administration (NARA) as the CUI Executive Agent with responsibility for implementing the order after consultation with the heads of executive agencies, as well as state, local, tribal, and private sector partners.
Executive Order 13636
On February 12, 2013, President Obama signed Executive Order 13636, “Improving Critical Infrastructure Cybersecurity” (E.O. 13636).3 E.O. 13636 is designed to better manage cyber risks to critical systems via: (1) information sharing, (2) privacy, and (3) the adoption of cybersecurity practices. E.O. 13636 directed the U.S. Department of Commerce, National Institute of Standards and Technology (NIST) to work with the private sector to develop standards for a Cybersecurity Framework based on best practices.
Over the past several months, actions taken to implement the requirements of E.O. 13556 and E.O. 13636 have provided significant insight into the cybersecurity requirements that will soon apply to contractors handling CUI information.
Want the Full Solicitation & Recompete Pipeline on This Topic?
GovPurchase tracks 1.2M+ active and historical records, contracting officers, and expiring awards.