DoD Cybersecurity Policy for U.S. Air Force Contracts

Introduction and Overview of the U.S. Department of Defense

The U.S. Air Force bears a major responsibility in protecting the lives and property of American citizens and their allies abroad. Today, this armed force must employ the most sophisticated, state-of-the-art information technology available to protect the nation's interests at home and abroad. The U.S. Air Force depends on a wide array of sophisticated computer and software systems, and it is essential to maintain these networks securely. The mission of the professionals at the U.S. Air Force's Cyber Systems Operations is to design, install, and support these state-of-the-art networks to ensure they operate properly and remain secure from intrusion by malicious actors.

According to its official website, the U.S. Department of Defense (DoD) is the oldest and largest government agency in the country. The overarching mission of the DoD is to "provide the military forces needed to deter war and to protect the security of our country" (About the Department of Defense, 2017, para. 3). Established during the pre-Revolutionary era, the DoD has transformed into a major public and private sector employer with more than 1.3 million active duty service members and nearly three-quarters of a million civilian employees.

DoD-Compliant Policies for IT Infrastructure

The mission of the U.S. Air Force Cyber Security Center (AFCSC) is critically important to national safety, especially in the post-September 11, 2001 environment. Private sector companies working with the AFCSC must therefore develop proper Department of Defense (DoD) security policies that satisfy DoD standards for the delivery of technology services. Pursuant to Department of Defense Instruction (DoDI) 8510.01 (March 12, 2014), the policy of the DoD states in part that:

• The DoD will establish and use an integrated enterprise-wide decision structure for cybersecurity risk management (the RMF) that includes and integrates DoD mission areas (MAs) pursuant to DoDD 8115.01 and the governance process prescribed in this instruction.
• The cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principles established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.
• The RMF must satisfy the requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the Federal Information Security Management Act (FISMA) of 2002.
• DoD must meet or exceed the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.
• All DoD information systems (IS) and platform IT (PIT) systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from NIST SP 800-53, and use assessment procedures from NIST SP 800-53A and DoD-specific assignment values, overlays, implementation guidance, and assessment procedures found on the Knowledge Service (KS).
• As supporting reference security control documents are updated, DoD's implementation of these updates will be coordinated through the RMF Technical Advisory Group (TAG).
• Each DoD IS, DoD partnered system, and PIT system must have an authorizing official (AO) responsible for authorizing the system's operation based on achieving and maintaining an acceptable risk posture.
• Reciprocal acceptance of DoD and other federal agency IS and PIT system authorizations will be implemented to the maximum extent possible. Refusals must be timely, documented, and reported to the responsible DoD Component senior information security officer (SISO).
• IT products, including applications, will be configured in accordance with applicable Security Technical Implementation Guides (STIGs) under a cognizant Information System Security Manager (ISSM) and security control assessor (SCA). STIGs are product-specific and document applicable DoD policies, security requirements, best practices, and configuration guidelines. Security Requirements Guides (SRGs) are developed by DISA to provide general security compliance guidelines and serve as source guidance documents for STIGs. When a STIG is not available for a product, an SRG may be used.

Based on the foregoing DoD requirements and guidelines, the following policies should be implemented:

Email: All email correspondence shall conform to the requirements of the DoD's procedures for enterprise and security gateways. According to the DoD's guidance, the DoD Enterprise Email (DEE) service provides secure cloud-based email to the DoD enterprise that is designed to increase operational efficiency and facilitate collaboration across organizational boundaries. As an enterprise service, DEE reduces the cost of operations and maintenance by consolidating hardware into the Defense Information Systems Agency's (DISA's) secure, global data center locations, thereby meeting both the DoD's strategic consolidation initiatives and mission partner messaging requirements (DoD Enterprise Email, 2017, p. 2). The security policies required by the DoD for email communications will be strictly followed by the company and its personnel in all cases. Violations of these security policies may result in disciplinary actions up to and including termination and/or criminal prosecution.

Confidentiality: The DoD has implemented instructions that prohibit contracting with private sector organizations that require internal confidentiality agreements that could interfere with whistleblowing by concerned employees. According to Stamp (2017), "Under a class deviation issued by DoD on November 14, 2016, no funds may be used to contract with a business that prohibits or restricts its employees or sub-contractors from reporting waste, fraud, or abuse to a designated investigative or law enforcement representative of a federal department or agency" (para. 2). The DoD requires that private sector organizations seeking to conduct business with the federal government provide assurances that they do not have internal confidentiality policies that would prevent employees or subcontractors from reporting instances of fraud, abuse, or waste of government funds (Stamp, 2017). The company must therefore ensure that all DoD-related information is strictly protected, while also ensuring that employees and subcontractors are permitted to report cases of intentional or unintentional waste, fraud, or abuse of federal government funds. Violations of this policy can result in disciplinary actions up to and including termination and/or criminal prosecution.

Deliverables: The DoD's contract with the company stipulates that all deliverables must comply with the relevant laws required for DoD contracts, as discussed further below.

Compliance Laws Required for DoD Contracts

Given the importance and complexity of the DoD's overarching mission to protect the United States and its interests, it is not surprising that the DoD has implemented a wide range of compliance laws required for contracts with private sector organizations. Some of the more salient laws in this context include the following:

DoD DFARS Subpart 204.73 — Safeguarding Covered Defense Information and Cyber Incident Reporting (Revised October 21, 2016). This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security requirements. It also requires the reporting of cyber incidents. This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program (Subpart 204.73, 2016, p. 1). According to Stanton and Cassidy (2017), "The protections required to protect Government information are dependent upon the type of information being protected and the type of system on which the information is processed or stored. Thus, different information is subject to different protections depending upon whether it is housed on contractor or DOD systems" (para. 2).

FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems, is a mandatory federal standard developed by NIST in response to FISMA. To comply with this federal standard, organizations first determine the security category of their information system in accordance with FIPS Publication 199, derive the information system impact level from the security category in accordance with FIPS 200, and then apply the appropriately tailored set of baseline security controls in NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations. Organizations have flexibility in applying the baseline security controls in accordance with the guidance provided in Special Publication 800-53, allowing them to tailor the relevant security control baseline to more closely align with their mission, business requirements, and operational environments (FIPS Pub 200, 2006).

Defense Federal Acquisition Regulations Supplement (DFARS) revised guidelines on unclassified controlled technical information (UCTI) (October 2016). These more rigorous guidelines are intended to improve cybersecurity practices between the DoD and private sector organizations. The most significant changes include: (a) all contractors must be in full compliance with the requirements outlined in NIST 800-171; (b) contractors must report cyber incidents within 72 hours to the DoD; (c) all non-compliant aspects must be reported to the DoD within 30 days after contract award; and (d) compliance must extend to all operational aspects, including all suppliers and subcontractors storing, processing, and/or creating covered defense information (CDI) that is part of contract performance (Solutions for DFARs, 2017).

NIST Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. According to Langenberg (2016), "The Defense Federal Acquisition Regulation 204.73 consists of a limited selection of the controls from this document (SP 800-53). The best way to determine what steps you need to take to comply is to take both documents to your IT department, or contact a company that can perform a gap assessment to see where you are vulnerable. The biggest thing your company needs to do is have an assessment done as soon as possible. Then decide how you will comply with the DFARS clause 204.73 and get those procedures in place" (para. 2).

Network Penetration Reporting and Contracting for Cloud Services (Defense Federal Acquisition Regulation Supplement Parts 202, 204, 212, 239, and 252). On August 26, 2016, the DoD implemented updated cybersecurity regulations following the high-profile breach at the Office of Personnel Management that compromised secure data concerning more than 21.5 million government employees and contractors. In response, the DoD implemented stricter guidelines concerning private sector organizations' use of cloud computing resources (Wagner, 2016).

The above list is not exhaustive. It is vitally important to keep in mind that the DoD regularly updates its guidelines concerning IT security and private sector organizations, including the controls placed on domains in the IT infrastructure, as discussed further below.

References

About the Department of Defense. (2017). U.S. Department of Defense. Retrieved from https://www.defense.gov/About/.

Active Directory optimization reference architecture. (2010, December 15). U.S. Department of Defense. Retrieved from http://dodcio.defense.gov/Portals/0/Documents/DIEA/ADORA_Final_v1_20101215.pdf.

DoD Enterprise Email. (2017). U.S. Department of Defense. Retrieved from http://www.disa.mil/enterprise-services/applications/dod-enterprise-email.

DoDI 8510.01. (2014, March 12). U.S. Department of Defense. Retrieved from https://rmf.org/images/stories/rmf_documents/851001_2014.pdf.

FIPS Pub 200. (2006, March). U.S. Department of Defense. Retrieved from

Langenberg, K. (2016). Cyber security requirements for DoD contractors. Association of Procurement Technical Assistance Centers. Retrieved from http://www.aptac-us.org/cyber-security-requirements-dod-contractors/.

NIST Special Publication (SP) 800-53 Revision 4. (2013, April 30). National Institute of Standards and Technology. Retrieved from

RMF for DoD IT. (2017). Lunar Line. Retrieved from

Solutions for DFARs. (2017). RegDox. Retrieved from https://www.regdox.com/regulatory-compliance-solutions/dfars/.

Stamp, M. E. (2017, January 25). New confidentiality agreement restrictions for DoD contractors. Protorae Law LLC. Retrieved from

Stanton, P., & Cassidy, S. (2017, February 8). DoD further clarifies its DFARS cybersecurity requirements. Covington. Retrieved from https://www.insidegovernmentcontracts.com/2017/02/dod-clarifies-dfars-cybersecurity-requirements/.

Subpart 204.73. (2016). U.S. Department of Defense. Retrieved from http://www.acq.osd.mil/dpap/dars/dfars/html/current/204_73.htm.

Wagner, W. C. (2016, September 22). Introduction to the new DoD cyber security regulations. Privacy & Data Security Insight. Retrieved from http://www.privacyanddatasecurityinsight.com/2015/09/introduction-to-the-new-dod-cyber-security-regulations/.