Covered Defense Information, Including Controlled Unclassified Information
On October 21, 2016, the Department of Defense (DoD) published the final rule for Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.” This represents DoD’s ongoing efforts to prevent improper access to important unclassified information. As a result, contractors must provide security for “covered contractor information systems,” to include implementing the security controls of National Institute of Standards and Technology (NIST) SP 800-171. A covered contractor information system is an unclassified information system that is owned or operated by or for a contractor and that also processes, stores, or transmits covered defense information (CDI).
APL’s Annual Representations and Certifications includes questions about your company’s ability to handle CDI, such as Controlled Unclassified Information (CUI), in compliance with the cyber DFARS clause 252.204-7012. We recommend that you check with your IT security professionals and legal counsel during the certification process.
It is our policy to only share CDI with suppliers who have assured us that they are capable of handling it. In particular, DFARS 252.204-7019 requires that contractors perform self-assessments that are submitted to the Supplier Performance Risk System (SPRS) before working with CUI. DFARS 252.204-7020 also requires that suppliers be verified.
The applicable flow-down clauses are included in APL’s terms and conditions for its partner suppliers. The DFARS clauses are required to be flowed down in any subcontracts or similar contractual agreements in which subcontract performance will involve CDI, including CUI. This clause must be flowed down without modification. We appreciate your partnership to minimize risk and safeguard our sensitive information.