The Protests Are Coming: Draft DoD Guidance Reveals How Cyber Readiness Will Impact Contract Evaluations

PilieroMazza PLLC
Contact

PilieroMazza PLLC

We have been blogging and giving webinars since last year about the DoD requirements around cybersecurity for contractors that are subject to DFARS 252.204-7012. Please view our past blogs and webinars here and here to get more of the backstory. In a nutshell, DoD contractors operating nonfederal IT systems and subject to DFARS 252.204-7012 were required to have a system security plan (“SSP”) in place by December 31, 2017, to demonstrate compliance with the recommended security controls in NIST SP 800-171. Although the DFARS requirements were black-and-white, there was a fair amount of uncertainty late last year and continuing into this year about what contractors needed to do to comply and if/how DoD would enforce the requirements.

DoD has taken some of the mystery out of these cyber requirements in a recently-released draft guidance. The draft guidance provides details on how DoD will review contractors’ SSPs. The objective is to ensure consistent review of SSPs by DoD. Knowing how DoD plans to review SSPs will also help contractors to build a better SSP. Additionally, and more impactful, is the draft guidance from DoD on how it may evaluate SSPs as part of the source selection process for contracts subject to DFARS 252.204-7012 that require implementation of NIST SP 800-171. This guidance indicates that a contractor’s SSP demonstrating compliance with NIST SP 800-171 will be a required part of the contractor’s proposal and may be used as a “go/no go” factor or assessed as a separate technical evaluation factor. It does not take a crystal ball, then, to see that the future of DoD procurements subject to DFARS 252.204-7012 will involve protests. The protests will likely range from contractors challenging their exclusion from the competitive range or the rejection of their proposal based on failure to submit a suitable SSP to disappointed bidders challenging DoD’s failure to evaluate either their SSP and/or the awardee’s SSP in accordance with DoD’s guidance for reviewing SSPs.

The Federal Register notice is available here, and the draft guidance is available here and here. DoD is soliciting comments until May 31, 2018. DoD contractors should review the guidance in preparing their SSPs, with an eye toward the likelihood that SSPs will become a more routine part of proposals to DoD in the near future. Please contact me if you have comments you would like to have submitted on the draft guidance and for assistance in preparing your SSP or assessing a potential protest related to a solicitation containing an SSP requirement.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© PilieroMazza PLLC | Attorney Advertising

Written by:

PilieroMazza PLLC
Contact
more
less

PilieroMazza PLLC on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.