Uncontrolled Information: DoD Audit Finds Contractor Lapses in Protecting Controlled Unclassified Information
Client Alert | 1 min read | 08.02.19
The Department of Defense Inspector General has released a much-anticipated audit report regarding the protection of Controlled Unclassified Information (CUI) on contractor networks. Begun last summer at the Defense Secretary’s request, the audits found that contractors are not consistently implementing cybersecurity standard NIST SP 800-171, despite being required to do so under DFARS 252.204-7012. The report calls particular attention to common shortcomings regarding multifactor authentication, strong passwords, vulnerability management, and removable media, among others.
The report recommends that DoD:
- Verify that contractors are identifying, responding to, and reporting cyber incidents involving CUI;
- Assess contractors’ ability to protect CUI as part of the solicitation process; and
- Validate, at least annually, that contractors are complying with their contractual cybersecurity requirements.
These recommendations are consistent with recent DoD efforts to establish a “Cybersecurity Maturity Model Certification” that would require contractors to be certified compliant with contractually-specified cybersecurity requirements to be eligible for award.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 5 min read | 06.01.26
California Court Upholds Insurer’s Duty to Defend After Covered Claim Is Dismissed
On April 30, 2026, the U.S. District Court for the Northern District of California issued a significant ruling in an insurance coverage dispute between a commercial general liability insurer and its policyholder. The decision addresses several critical issues in insurance law, including the scope and continuity of the duty to defend and the standard for insurer reimbursement of defense costs in mixed-claim actions. The court ruled largely in favor of the insured, SVO Building One, LLC ("SVO"), and the matter now heads toward settlement or trial on SVO's remaining counterclaims.
Client Alert | 2 min read | 05.29.26
California Assembly Passes AB 1776, Sending Major Antitrust Bill to the Senate
Client Alert | 5 min read | 05.29.26
Clover Insurance v. HHS: S.D. of Georgia Holds 20 Star Ratings Measures Unlawful
Client Alert | 3 min read | 05.29.26
