The National Institute of Standards and Technology (NIST), in coordination with the Department of Defense (DoD) and the National Archives and Records Administration (NARA), will host a Workshop providing an overview of Controlled Unclassified Information (CUI) on October 18, 2018. The agenda for the Workshop shows a full day of panels, including those addressing DoD’s “Safeguarding Covered Defense Information and Cyber Incident Reporting” Clause (DFARS Cyber Rule), overviews of NIST Special Publications (SPs) 800-171 and 800-171A, and Government expectations when evaluating contractor implementation of the 800-171 security controls.

In addition to the panels described in the agenda, the Workshop may provide an opportunity to address questions about DoD’s April 2018 draft guidance for the Department’s assessment of contractors’ System Security Plans (SSPs) and implementation of the security controls in NIST SP 800-171. As we noted in a recent blog post, this guidance raises questions about what role offerors’ implementation of NIST SP 800-171 — and their SSPs and Plans of Action and Milestones (POA&Ms) – may play in bid protests. Likewise, questions remain as to how SSPs and POA&Ms will be addressed in DCMA audits, how DoD will evaluate cybersecurity as part of ongoing performance, and whether DoD’s intended uses of an SSP could increase the risks associated with the False Claims Act.

The Workshop also may offer some insight into a new cybersecurity regulation that is expected later this year. The January 2018 Semiannual Regulatory Agenda published by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council noted that a proposed rule addressing cybersecurity for all Executive agencies is expected to be issued in November of this year. NIST SP 800-171 already states that the security controls in that publication are expected to be incorporated into this proposed rule. Thus, this Workshop may provide some insight into the content of the expected FAR cybersecurity rule and whether it will result in any changes to the DFARS Cyber Rule.

The NIST Workshop is open to all interested stakeholders and is free to attend. Registration for in-person attendance can be made at the NIST website and is required by October 11, 2018. NIST has stated that the Workshop also will be available via webcast. Advanced registration is not required for the webcast.