{"id":28597,"date":"2017-05-11T12:48:04","date_gmt":"2017-05-11T12:48:04","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2017\/05\/11\/defense-contractors-unsure-how-to-comply-with-dod-cyber-regs-says-report\/"},"modified":"2026-08-08T18:34:04","modified_gmt":"2026-08-08T18:34:04","slug":"defense-contractors-unsure-how-to-comply-with-dod-cyber-regs-says-report","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/home\/2017\/05\/11\/defense-contractors-unsure-how-to-comply-with-dod-cyber-regs-says-report\/","title":{"rendered":"Defense contractors unsure how to comply with DoD cyber regs, says report"},"content":{"rendered":"\n

A requirement for contractors with Department of Defense facility security clearances to create a written insider threat program plan has left those affected with unanswered questions, according to a report by international law firm Crowell & Moring LLP.<\/span><\/p>\n\n\n\n

In the firm’s third annual regulatory outlook, “Regulatory Forecast 2017: What Trump Means for Business,” Crowell & Moring touch on the opportunities, challenges, risks and reforms in nine focus areas.<\/span><\/p>\n\n\n\n

A key takeaway in cybersecurity regulation is contractors must proactively engage with the DoD’s Defense Security Service to avoid compliance issues with the amended National Industrial Security Operating Manual.<\/span><\/p>\n\n\n\n

The five minimum requirements for the insider threat program are that a senior official be designated to establish and execute it; a written implementation plan be developed; “relevant and credible information” regarding potential insider threats be reported; managers and all cleared employees must go through training with annual refreshers; and information security controls must be on classified information systems to monitor activity.<\/span><\/p>\n\n\n\n

However, questions linger about plan logistics, content and training and how to implement a program consistent with legal, civil liberties and privacy policies. Therefore, privacy experts should be key advisors early and often when crafting a program, says Crowell & Moring partner Adelicia Cliffe.<\/span><\/p>\n\n\n\n

Additionally, interdisciplinary teams could assist collaboration across management, legal and technical groups. Resources to comply and monitor compliance could be significant, so should be planned for in advance. Subcontractors, vendors and other business partners could also provide an avenue to sensitive material, so contractors should consider extending training programs to third parties. And contractors should use the program as a reason to review and upgrade their current IT, security policies and security procedures.<\/span><\/p>\n\n\n\n

Because of the developing regulations and standards being imposed by governments, as well as the fear of increasingly sophisticated cyberattacks and litigation, Crowell & Moring sees cybersecurity shifting to a team focus that includes risk managers, lawyers and CEOs alongside IT professionals.<\/span> <\/span><\/p>\n\n\n\n

The entire report, which looks at how the new administration, Congress and the federal courts are reshaping the regulatory state and impacting businesses, can be downloaded on Crowell.com<\/a>. <\/span><\/p>\n\n\n\n

The firm will also be hosting an ongoing webinar and podcast series to discuss the impact on business of the Trump administration’s first year, focusing on developments in four topics: <\/span><\/p>\n\n\n\n