This document summarizes a webinar on recent updates to federal cybersecurity and supply chain requirements from NARA, NIST, and OSD. The webinar covered new regulations on prohibiting procurement of equipment from Huawei due to supply chain risks, the DoD's CMMC initiative to establish a unified cybersecurity standard, and changes requiring contractors to comply with NIST SP 800-171 requirements. It provided an overview of the various regulations and guidance documents that inform federal cybersecurity practices.

1. FED GOV CON
Webinar Wednesdays
2019 Series
JSchaus & Assoc.
Washington DC
+ 1 – 2 0 2 – 3 6 5 – 0 5 9 8
1

2. About Our Webinars:
- Every Wednesday;
- Complimentary;
- Recorded;
- YouTube & our Website;
- No Questions
2

3. About Us:
Professional Services for
Federal Contractors
- GSA Sched;
- SBA 8(a);
- Proposal Writing;
- Pricing;
- Contract Administration;
- Business Development
3

4. Upcoming Events:
10/24 – CLASS
Teaming & Partnering
https://teamingstrategies.eventbrite.com
12/3 – CONFERENCE
4th Annual Doing Business With
DoD & The Intel Community
https://dodintel120319.eventbrite.com
4

5. Advertise in our
Newsletter:
We reach 15,700+ Subscribers
Includes Government &
Government Contractors
Hello@JenniferSchaus.com
5

6. About Our Speaker:
David Dempsey
Amherst College (1972)
University of South Carolina Law School
(1977)
Dempsey Fontana, PLLC
42 Years Federal Procurement Contract Law
6

7. Federal Cybersecurity and
Supply Chain Requirements
___________
UPDATES: NARA, NIST & OSD
7

8. FEDERAL CYBERSECURITY AND SUPPLY CHAIN REQUIREMENTS
UPDATES: NARA, NIST & OSD
Wednesday, September 25, 2019
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates
Disclaimer: The information contained herein is not, nor is it intended to be, legal advice. You should consult an attorney
for advice regarding your individual situation. We invite you to contact us and welcome your calls, letters and electronic
mail. Contacting us does not create an attorney-client relationship. Please do not send any confidential information to us
until such time as an attorney-client relationship has been established.
8

9. BACKGROUND TO “CYBERSECURITY”
Federal Information Security Management Act(s) (2002 / 2014)
NARA ESTABLISHES A “UNIFORM” PROGRAM FOR “CUI” (32
C.F.R.2002; 81 FED. REG. 63336; SEPT. 14, 2016) (“CUI BASIC,” CUI
SPECIFIC,” “CUI REGISTRY”)
INFORMATION SECURITY OVERSIGHT OFFICE
REVISED THE NISP ON MAY 7, 2018 (INSIDER THREAT, FOCI,
ACCESS TO CLASSIFIED)
FISMA to NARA to ISSO to NIST
9
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

10. ISOO’s CUI REGULATION INCORPORATES:
FIPS PUB 199, Standards for Security Categorization of Federal
Information and Information Systems;
FIPS PUB 200, Minimum Security Requirements for Federal
Information and Information Systems;
NIST SP 800-53 r4 Security and Privacy Controls for Federal Information
Systems and Organizations (updated through Jan. 2015);*
NIST SP 800-88, Guidelines for Media SANITIZATION r1 (DEC. 2014)
NIST SP 800-171 r1, Protecting [CUI] in Nonfederal Systems and
Organizations r1 (updated through June 2016) **
* Rev. 5 in final review
** Rev. 2 in final review
10
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written
approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

11. BACKGROUND TO “SUPPLY CHAIN REQUIREMENTS”
2013 NDAA: § 806
2014 NDAA: §§ 325, 811, 391, 942, 3113
2015 NDAA: §§ 834, 1628, 1632
2016 NDAA: §§ 238, 346
2017 NDAA: §§ 1641, 1650, 1841-44
2018 NDAA: §§ 807 (ENHANCED SUPPLY CHAIN SCRUTINY), 1631-1649,
1659, 1696
11
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

12. BACKGROUND TO “SUPPLY CHAIN REQUIREMENTS” (cont.)
2019 NDAA: §§ 1631-1657 (Cyberspace Related Matters)
§ 881 (Permanent authority relating “supply chain risk” to
“national security program”)
§ 889: Prohibition to purchase telecom equipment from
Huawei Technologies Company et. al. and 115 affiliates
(see 84 Fed. Reg. 43493, Aug. 21, 2019)
12
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written
approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

13. SUPPLY CHAIN CHANGES – § 889 (Huawei prohibition)
See FAR 4.21 / FAR 52.204-25 (Aug. 13, 2019) – Agencies cannot procure or extend or
renew a contract that supplies “covered telecommunications equipment” or services
that use “covered telecommunications equipment” as a substantial or essential
component of any system or as critical technology as part of any system
GSA intends to implement this procurement prohibition in Sept. 2019
FAR 52.204-24: Offeror represents that it [ ] will [ ] will not provide covered
telecommunications equipment in the performance of any contract, subcontract or
other contractual instrument resulting from this solicitation – if so then provide details
on the “covered telecommunications equipment” products / services and explain
why such equipment should be permitted
13
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written
approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

14. CYBERSECURITY CHANGES:
DoD issued on April 24, 2018 “DoD Guidance for Reviewing System Security Plans and
the NIST SP 800-171 Security Requirements Not Yet Implemented
https://www.acq.osd.mil/dpap/pdi/cyber/index.html
■ see DoD Guidance for Reviewing System Security Plans and the NIST SP 800-
171 Security Requirements Not Yet Implemented (Draft) – prioritizes the 110 NIST-171
standards by assigning a priority rating of 5 (highest) to 1 (lowest) (based on NIST SP
800-171(r.1, June 2018)
■ see “Assessing the state of a Contractor’s Internal Information System in a
Procurement Action” (Draft) Was the most useful DOD guidance issued for establishing
a NIST-171 compliant System Security Plan.
14
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written
approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

15. CYBERSECURITY CHANGES:
► February 26, 2019 DCMA Contractor System Purchasing Review (CPSR),
App. 24 (proposed increase for CPSR review threshold from $25 million
to $50 million (84 Fed. Reg. 25228; May 31, 2019)
► NMCARS 5204.7303-1(c) (Sept. 2019) “Consider” DFARS 252.204-7012 to be a
“material requirement” when included in contracts, task or delivery orders
Failure to comply: consider suspending/reducing progress payments or accept
supplies/services and modify the contract with a 5% price reduction
15
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

16. CYBERSECURITY CHANGES (cont.)
July 2019: DoD’s CMMC Initiative: Cybersecurity Model Maturity Certification
► https://www.acq.osd.mil/cmmc/
September 2019:CMMC Draft v.0.4 issued for comment seeking a “unified cybersecurity
standard” for DoD by mapping cybersecurity standards from NARA, NIST, ISO
27001:2013, CERT and “best practices” from the Defense Industrial Base community
(e.g., Center for Internet Security (cisecurity.org, NDIA, PSO, AIA National Aerospace
Standards)
16
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

17. CYBERSECURITY CHANGES (cont.)
CMMC objective: cost effective cybersecurity for large and small companies per:
18 domains comprised of capabilities (e.g., processes and controls regarding
such “domains” as access control, training, ID/authentication, media protection,
asset inventory, risk assessment, security assessment) (NIST has 14 domains)
Resulting in 5 Maturity Levels:
Basic Cyber Hygiene (Level 1)
Intermediate Cyber Hygiene (Level 2)
Good Cyber Hygiene (Level 3)
Proactive (Level 4)
Advanced (Level 5)
17
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

18. CYBERSECURITY CHANGES (cont.)
CMMC:
♦ measures maturity of a company’s cybersecurity practices/processes
♦ uses “CUI” not “CDI” as in DFARS 252.204-7012 (safeguard and
reporting clause) (vocabulary may be significant)
♦ CO identifies the CMMC Level for each contract in §§ L and M
♦ all businesses dealing with DoD (including subcontractors)
must be certified by an accredited third-party auditor regardless …
♦ role of DCMA and DCSA (formerly DSS) uncertain for audits
♦ CMMC v.1 released in January 2020 to facilitate training and by June
2020, CMMI requirements may appear in RFIs
18
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

19. OBSERVATIONS:
♦ Compliance with NIST SP 800-171 r1 will be easier than
compliance with a CMMC Level – but may restrict opportunities
♦ Familiarity with the NARA regulations is useful (definitions and CUI
registry)
♦ Search “Cyber Resilience Reviews” at us-cert.gov for a head start on
CMMC compliance
♦ Anticipate more agencies will adopt the NMCARS “approach”
19
© September 2019 All Rights Reserved No part of this information may be reproduced without the prior written approval of the author.
2019 – Fed Gov Con Webinar Series - Washington DC
JSchaus & Associates

20. THANK YOU!
JSchaus & Assoc.
Washington DC
hello@JenniferSchaus.com
www.JenniferSchaus.com
+ 1 – 2 0 2 – 3 6 5 – 0 5 9 8
Speaker: David Dempsey
Email: ddempsey@deftlaw.com
Phone: 703-880-9171
20