It should come as no surprise that the contracting policy changes in the National Defense Authorization Act for 2014 [pdf] reflect a continued focus on reducing spending. But they also encourage collaboration between the government and the private sector and emphasize the need for innovative contracting strategies and greater flexibility in the procurement process, which may benefit contractors in the long run. Here is a breakdown of a few of the highlights:

  • Extension of restrictions on contractor services spending. Section 802 of the 2014 NDAA amends Section 808 of the 2012 NDAA to extend the temporary limit on the amounts obligated for DOD spending on contract services in FY 2014 to the amount requested for contract services in the President’s budget for FY 2010. It also requires that the heads of each Defense Agency continue the 10-percent-per-fiscal-year reductions in spending for staff augmentation contracts and contracts for inherently governmental function for FY 2014, and requires that any unimplemented amounts of the 10 percent reductions for FY 2012 and FY 2013 be implemented in FY 2014.
    Continue Reading Procurement reforms in the FY 2014 National Defense Authorization Act

The United States Defense Department has published a final cybersecurity regulation concerning unclassified “controlled technical information.” See 78 Fed. Reg. 69,273 (Nov. 18, 2013) [pdf]. The objective of the regulation is to require contractors to maintain “adequate security” on unclassified information systems on which CTI may reside or transit and to implement detailed reporting requirements for “cyber incidents.” The final rule is narrower than the proposed regulation, which sought to safeguard unclassified DoD information generally.  See 76 Fed. Reg. 38,089 (June 29, 2011) [pdf].

Definition of CTI

The final rule includes a new DFARS provision (DFARS 204.7300) and a DFARS contract clause (DFARS 252.204.7012), which impose new security measures and reporting requirements on contractors and subcontractors whose work involves unclassified “controlled technical information resident on or transiting through contractor information systems.”

The rule broadly defines CTI as “technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.”  DFARS 204.7301.

The term “technical information” is further defined to mean “recorded information, regardless of the form or method of the recording, of a scientific or technical nature . . . .” See DFARS 252.227-7013. Examples of technical information include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

While this is a broad definition, comments on the new rule limit its application to information requiring controls pursuant to DoD Instruction 5230.24 [pdf] and DoD Directive 5230.25 [pdf]. Contractors should not have to devote resources simply to the task of determining whether information is CTI or not.


Continue Reading DoD’s new cybersecurity rules on unclassified “controlled technical information”