j1of1 Posted June 3, 2016 Report Share Posted June 3, 2016 In another step in a series to strengthen protection of information systems DoD on 16 May 2016 added a new FAR subpart 4.19 and contract clause 52.204-21 for the "Basic Safeguarding of Covered Contractor Information Systems." The focus of this new rule is on the safeguarding of contractor information SYSTEMS that are owned or operated by a contractor that processes, stores or transmits Federal contract information. Previous cybersecurity guidance (DFARS) was released - and is still in effect - regarding protecting information. This new rule pertaining to information SYSTEMS becomes effective this month (June, 2016) for new contracts or when the contractor accepts the clause. There is a FLOWDOWN requirement. Contractors must flow down the requirement to safeguard information systems to subcontracts at all tiers under the effected contract in which "the subcontractor may have Federal information residing in or transiting through its information system." My question: Is the flow-down requirement applicable to foreign contractors and ITAR data that has been shared through State? Link to comment Share on other sites More sharing options...
Don Mansfield Posted June 3, 2016 Report Share Posted June 3, 2016 Why wouldn't it be? Link to comment Share on other sites More sharing options...
Navy_Contracting_4 Posted June 22, 2016 Report Share Posted June 22, 2016 The clause seems unambiguous - Quote (c) Subcontracts. The Contractor shall include the substance of this clause, . . . in subcontracts . . . in which the subcontractor may have Federal contract information residing in or transiting through its information system. There is no exception for foreign subcontractors. If you want to exclude one or more foreign contractors from the application of this clause, approval of a deviation from the FAR would seem to be needed. In today's environment, I think it unlikely that such an approval would be easy to obtain. If you're unsure whether the "ITAR data that has been shared through State" meets the definition of "Federal contract information," ask your contracting officer. Link to comment Share on other sites More sharing options...
Recommended Posts