Federal Contractors Want Guidance from Feds on OPM Hack

Like federal employees, federal contractors are waiting for agencies to explain exactly what the OPM data breach affecting 4 million employees means for them.

“Everyone’s on standby to find out if they are impacted,” said Pam Walker, senior director for homeland security at the information industry’s IT Alliance for Public Sector. “I know companies are working with OPM” and the Office of Management and Budget, which is preparing governmentwide cybersecurity guidance. Much of the governmentwide work, Walker notes, was in progress before the OPM breach.

Contractor representatives say they’re monitoring the National Archives and Records Administration, whose Information Security Oversight Office posted a proposed rule in the Federal Register last month to update policy detailing how agencies should designate, safeguard, disseminate and dispose of information that by law or regulation is sensitive but not formally classified.

The National Institute of Standards and Technology is planning by the end of June to release final guidance, called SP 800-171, on protecting sensitive government information on contractors’ computers. “This work began more than a year ago and is focused on controlled but unclassified information in nonfederal information systems and organizations,” said spokeswoman Evelyn Brown.

At the Defense Finance and Accounting Service, spokesman Tom LaRock told Government Executive Wednesday that “while DFAS doesn’t discuss specific security measures taken to protect our customer’s Personally Identifiable Information, protection of that data is our top priority. We continually monitor our systems for unauthorized intrusions and continually update our cybersecurity tools and capabilities.”

Read more: Federal Contractors Want Guidance from Feds on OPM Hack