The Pentagon\u2019s top acquisition official said the department is working with government agencies to develop cybersecurity standards that industry partners would need to follow before they can win a contract.<\/p>\n\n\n\n
Ellen Lord, the Pentagon\u2019s undersecretary for acquisition and logistics, said in a March 25 event that the department is working with officials from the National Institute of Standards and Technology and hopes to have new metrics on minimum cybersecurity practices later this year. NIST helps provide IT standards for federal government agencies.<\/p>\n\n\n\n
Ideally, she said, the Defense Department would begin to use those standards within the next 18 months to help determine whether to award a business a contract.<\/p>\n\n\n\n
\u201cWe are deriving cybersecurity standards form the NIST standards,\u201d she said. \u201cWe will have metrics associated with those. We\u2019ll stand up third-party auditors.\u201d<\/p>\n\n\n\n
Lord expects to work with officials from the Johns Hopkins University Applied Physics Laboratory on the project as well.<\/p>\n\n\n\n
\u201cWe\u2019re probably 18 months out from making those a clear discriminator in terms of acquisition downselects,\u201d she said.<\/p>\n\n\n\n
In the past two years, Pentagon officials have become increasingly concerned that one of their greatest cybersecurity risks lies in the second- and third-tier contractors who work with the Defense Department and the largest defense companies.<\/p>\n\n\n\n
In September, Patrick Shanahan, then the department\u2019s deputy secretary and now the acting secretary, said cybersecurity would become a key measurement for how industry is judged by the department. He called it the \u201cfourth critical measurement\u201d behind quality, cost and schedule.<\/p>\n\n\n\n
\u201cSecurity is one of those measures that we need to hold people accountable for,\u201d he said.<\/p>\n\n\n\n
But the issue becomes complicated for smaller contractors with fewer resources.<\/p>\n\n\n\n
In written testimony dated March 26 to the Senate Armed Services Committees cybersecurity subpanel, John Luddy, the vice president for national security at the Aerospace Industries Association, said while he applauded the idea of reporting breaches and applying standards, \u201cthe dynamic nature of cyber security today makes it extremely difficult for small to mid-size suppliers to create self-sustaining cyber security programs capable of managing the risk posed by advanced adversaries.\u201d AIA has suggested its own standards for cybersecurity, one that it argues is not a one-size-fits-all checklist for compliance.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Pentagon is working with government agencies to develop cybersecurity standards that industry partners will soon need to follow before they can win a contract.<\/p>\n","protected":false},"author":7,"featured_media":69354,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"10":{"categories":["pentagon","daily-news-roundup","newsletters"],"primary_category":"pentagon"}}},"categories":[10],"tags":[],"coauthors":[3222,3361],"class_list":["post-22647","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"FQXUIYKMSRCWHL7FAWEL5ZEEMQ","arc_canonical_url":"\/dod\/2019\/03\/26\/pentagon-hopes-to-have-new-cybersecurity-standards-for-contractors-in-2020\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n