This briefing covers active market intelligence, regulatory guidelines, and tactical capture recommendations for federal and defense contractors pursuing opportunities in this procurement classification.
Yesterday, the Federal Acquisition Regulations (“FAR”) Council published the final FAR rule on Basic Safeguarding of Contractor Information Systems.1 The rule is intended to prescribe “the most basic level” of safeguards, “reflective of actions a prudent business person would employ.”2
Applicability
The rule, which includes a new contract clause, will apply to all acquisitions by any federal executive agency, beginning June 15, 2016, when a contractor’s information system may contain “Federal contract information,” including acquisitions below the simplified acquisition threshold and for commercial items other than commercially available off-the-shelf (“COTS”) items.3
A key factor in applying the new rule is whether a contractor’s information system contains “Federal contract information.” That term is defined intentionally broadly as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information by the Government to the public (such as that on public websites) or simple transaction information, such as that necessary to process payments.”4The safeguarding requirements apply to all “covered contractor information systems,” namely, those information systems owned or operated by a contractor that process, store, or transmit Federal contract information.5
The substance of the contract clause prescribed by the rule must be flowed down in all subcontracts, other than contracts for COTS items, in which the subcontractor may have Federal contract information residing in or transiting through its information systems.6
Safeguards
The contract clause requires contractors to implement fifteen specified safeguards, including access control; identification and authentication safeguards; media, physical, system, and communication protection; and system and information integrity. The fifteen safeguards are listed at the end of this discussion. Each of the listed safeguards is drawn from the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-171,7 which was intended to apply to more sensitive “Controlled Unclassified Information” (“CUI”).
Read more: Final Government Contractor Basic Data Security Rule Issued
Want the Full Solicitation & Recompete Pipeline on This Topic?
GovPurchase tracks 1.2M+ active and historical records, contracting officers, and expiring awards.