Uncontrolled Information: DoD Audit Finds Contractor Lapses in Protecting Controlled Unclassified Information
Client Alert | 1 min read | 08.02.19
The Department of Defense Inspector General has released a much-anticipated audit report regarding the protection of Controlled Unclassified Information (CUI) on contractor networks. Begun last summer at the Defense Secretary’s request, the audits found that contractors are not consistently implementing cybersecurity standard NIST SP 800-171, despite being required to do so under DFARS 252.204-7012. The report calls particular attention to common shortcomings regarding multifactor authentication, strong passwords, vulnerability management, and removable media, among others.
The report recommends that DoD:
- Verify that contractors are identifying, responding to, and reporting cyber incidents involving CUI;
- Assess contractors’ ability to protect CUI as part of the solicitation process; and
- Validate, at least annually, that contractors are complying with their contractual cybersecurity requirements.
These recommendations are consistent with recent DoD efforts to establish a “Cybersecurity Maturity Model Certification” that would require contractors to be certified compliant with contractually-specified cybersecurity requirements to be eligible for award.
Contacts
Partner, Crowell Global Advisors Senior Director
Insights
Client Alert | 6 min read | 08.14.25
Changes in Sunscreen Regulation & Litigation are Heating Up: Updates from Congress to the Courts
In an effort to update and modernize the FDA’s regulation of sunscreen, Representative John Joyce (R-Ohio) and a group of bipartisan members of Congress introduced in June the Supporting Accessible, Flexible, and Effective Sunscreen (SAFE) Standards Act. If enacted, the bill would establish a more flexible regulatory scheme at the FDA, decrease the cost in the approval process and expand the array of sunscreen available for purchase.
Client Alert | 3 min read | 08.14.25
DSIT's latest findings on AI, other emerging technologies and cyber security
Client Alert | 3 min read | 08.13.25
Client Alert | 3 min read | 08.13.25
Faster Audits, More ADR: IRS Rolls Out Significant LB&I Changes
