5 steps for contractors to meet the FAR's cyber requirements

With major data breaches and system hacks dominating the headlines over the past few years, cybersecurity has become a top consideration for anyone operating a business. Although these breaches affect companies from all industries, the government remains a top target for cybercriminals across the globe.

Widespread attempts to take down government systems and steal data have officials scrambling to eliminate risk from all angles.

Recognizing the devastating impact of data breaches, especially considering the sensitive nature of their respective data, the Department of Defense, NASA, and the General Services Administration collaborated on developing safeguards for contractors who store, transmit, and process federal data – a new subpart and contract clause to the Federal Acquisition Regulation (FAR).

The proposed FAR Rule was first issued in August 2012, but the ruling was not finalized until May 2016 – nearly four years later.

The requirements settled upon in the final ruling outline 15 categories of security controls meant to protect government information stored on contractor IT systems. With the federal government spending over $400 million on almost 4 million contracts in 2015 alone, this regulation will affect businesses of all types.

Below are five core components of the mandate that contractors must adhere to, which will not only ensure continued eligibility for government work, but will boost organizations’ general preparedness for cyber incidences and threats.  

Increase employee awareness and accountability

Although cyber defense is typically considered dependent on technology, people serve as the first wall of defense from an attack.

The mandate requires that all contractors and their employees have a general understanding of the cyber risks faced by their respective businesses. However, it is not just a matter of educating employees on best practices to mitigate risk, but rather continuing to monitor employee behavior to ensure appropriate conduct.

The mandate addresses this by requiring the creation of audit records where compromising information system activity is reported and traced to individual users so that employees can be held accountable for their actions. 

Control access to sensitive information

Another major focus of the regulation is limiting both who is able to access networks and data and how it can be accessed. Many companies’ intranets and networks are open to all employees. Restricting access to sensitive information can significantly reduce internal threats to the system.

The mandate requires that in order for users to access systems and networks containing sensitive information, their identities need to be verified in advance. Knowing and limiting who can access the network and when they access it allows for the path that leads to a breach or incident to be traced, which can help speed up the response and investigation process.

Prepare for incident response

When businesses are struck with a breach, they often do not have a process in place to guide them in a swift and effective response. Since incidences and breaches can never be fully prevented, having a response plan for when they do occur is essential.

With this new regulation, contractors will have to establish a process for tracking, documenting, and reporting cyber incidences to the corresponding department or personnel. Employees must be briefed on how to respond if they see unusual or compromising activity on their networks, and businesses must lay out in explicit language what this looks like and the appropriate course of action.

Assess risk and security

Too often, businesses see their cybersecurity processes as static, but with rapidly changing technologies and the associated threats, this approach can quickly prove ineffective. Developing controls for systems is not a one-time process – they require regular monitoring and maintenance.

The mandate calls for periodic assessment of risks and the controls in place to respond. In the event that testing reveals the security measures are no longer effective, new courses of action must be designed and implemented to address the shortcomings.

Regular testing is not just beneficial for knowing when to update cyber defense controls – it also serve as a guide for how to tailor them to a specific business. Initially, controls put in place may be too broad, but as the business learns more about the threats they face, their approach to addressing them can become more targeted.

Ensure the integrity of communications

Communication is a vital piece of every business’s structure, but it can also be one of the most vulnerable points of penetration. All channels of communications, or information transmitted or received by businesses’ information systems, must be monitored for suspicious activity and controlled.

One particularly vulnerable channel is email – an integral part of nearly every business’s operation. Through email, cybercriminals can access a business’ system to plant malicious code or steal information. Monitoring the information coming in and out of email servers, as well as other communications channels, is the first line of defense from unwanted malicious contact.  

With historic evidence of threats targeting federal contractors, the FAR rule is a crucial step forward in ensuring the security of government information.

However, there is still room for improvement. While the mandate offers overarching guidelines, it is not as prescriptive as it needs to be, leaving several components open for interpretation. The contractor community is incredibly diverse, and although is commonly perceived as primarily technology and defense providers, the vast majority comprise manual labor services, like janitorial staff. In its current state, the mandate fails to provide guidance for these types of contractors that likely lack the capacity to take on such technical measures.

Regardless of its gaps, the FAR rule is law and sets the scene for what’s to come – contractors can expect increasing pressure to ensure the security of government data. Adapting to this new regulation may require a heavy investment of resources, especially for small- to mid-size companies.

However, once in place, they will help ensure the data security necessary for government contracts, protect contract work eligibility, and ultimately, position them for long-term success.