DFARS Update: 12/2017 Implementation Requirement Not a Grace Period

By Eric Noonan • January 8, 2016

The push to formalize cybersecurity controls via the DFARS started in 2007/2008 with the initial Defense Industrial Base (DIB) framework agreements being negotiated and signed on a company by company basis with the Department of Defense (DoD). This work matured to what became DFARS 252.204-7012 issued in 2013.

In July 2015, CyberSheath published the post “DFARS Cyber Security Requirements Growing Clearer.”  Since that posting there has been additional guidance and interim rules established by the DoD.  The interim rule, released in August 2015 amended 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls, and DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting which provided additional guidance and established NIST 800-171 as the standard by which defense contractors must adhere to the security requirements identified therein.

Recent DFARS Update

As recent as December 30, 2015, the DoD issued a second interim rule that extends the timeframe for implementation.  While the expectation was that contractors implement the cybersecurity controls as soon as possible, the public concern on the interim rules was that there was no reasonable amount of time to meet the requirements.   In response, the second interim rule gives defense contractors until December 31, 2017, to implement security control requirements specified in NIST 800-171.

What this Means for Your Organization

While this is a much more agreeable timeframe, it should not be viewed as a grace period.  Some of the controls outlined in 800-171 require substantial time, effort and budget cycles to implement.  The December 2017 deadline provides defense contractors with more breathing room but contractors are advised not to procrastinate, as this is an opportunity to implement the controls in a timely fashion, with compliance becoming an outcome of security rather than a separate checklist activity.

In reality, the “grace period” clock started ticking in 2008 and since then the requirements have steadily become more clear and enforceable. The time to act to achieve compliance by 2017 is now!

Don’t Know Where to Begin?

CyberSheath will work with your organization, large or small, to meet the regulatory requirements and be compliant by the December 2017 deadline.  CyberSheath offers security assessments to help your organization begin with a clear understanding of where you stand in regards to industry standards and regulations.

CyberSheath Blog

CyberSheath Opens Registration For CMMC CON 2022

RESTON, Va. — June 8, 2022 — Federal contractors have been searching for direction after seeing a flood of messaging about the future of Cybersecurity Maturity Model Certification (CMMC). The nation’s largest CMMC conference has returned to help contractors navigate their course through the evolving compliance landscape.   Hosted by…

5 Reasons to Partner with CyberSheath

The threat landscape is only becoming more complex. Offload the responsibility of navigating cybersecurity issues for your customers by taking advantage of CyberSheath’s new Partner Program.   As a pioneer and industry leader in the managed security service provider space, our new offering helps you achieve rapid results and deliver…

CMMC Compliance Training: How to Earn Your Black Belt

Contractors in the Defense Industrial Base (DIB) are looking for direction as Cybersecurity Maturity Model Certification (CMMC) 2.0 nears. Compliance with CMMC and Defense Federal Acquisition Regulation Supplement (DFARS) is your key to doing business with the Department of Defense (DoD) and we can help you navigate those requirements and…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO