DFARS
|
Prescription
|
| 252.204-7008 Compliance with Safeguarding Covered Defense Information (Oct 2016) |
All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items |
| 252.204-7009 Limitation on the Use or Disclosure of Third Party Contractor Reported Cyber Incident Information (Oct 2016) |
All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, for services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting |
| 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (Oct 2016) |
All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, except for solicitations and contracts solely for the acquisition of COTS items |
| 252.239-7009 Representation of Use of Cloud Computing (Sept 2015) |
All solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial item, for information technology services |
| 252.239-7010 Cloud Computing Services (Oct 2016) |
All solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial item, for information technology services |
NIST SP 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal information systems and organizations. Generally, Department of Defense contractors, except COTS suppliers, are required to implement these security requirements by no later than December 31, 2017. Please refer to DFARS 252.204-7008, DFARS 252.204-7012 and NIST SP 800-171 for more details.
