NIST Offers a Two-for-One Special on Cybersecurity Updates
Client Alert | 1 min read | 06.20.18
The government’s leading authority on cybersecurity standards has issued two updates relevant to government contractors working with DoD sensitive data. First, the National Institute of Standards and Technology (NIST) updated Special Publication (SP) 800-171, the security standard required by the DFARS Safeguarding Clause 252.204-7012 and also expected to be required under a pending FAR Clause. In addition to nuanced security control revisions, notable changes include the addition of Appendix F, which discusses security requirements derived primarily from the separate standard NIST SP 800-53 in an effort to inform organizations about mechanisms and procedures used to implement required safeguards. Second, NIST finalized its draft of NIST SP 800-171A. This sister document provides guidance in assessing NIST SP 800-171 security controls, including System Security Plans (SSPs) and Plans of Action and Milestones (POAMs). Changes in the finalized guidance include the removal of NIST SP 800-53 guidance in Appendix D and its replacement with three assessment methods – Examine, Interview, and Test – that can be used to assess security requirements under NIST SP 800-171.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 3 min read | 06.12.26
DOJ Guidance Backs Away From Disparate Impact Liability
On June 9, 2026, the U.S. Department of Justice (DOJ) issued a formal opinion concluding that the Equal Opportunity Employment Commission’s (EEOC) existing interpretations of Title VII of the Civil Rights Act of 1964 (Title VII) disparate-impact liability, including the Uniform Guidelines on Employee Selection Procedures (UGESP), are unconstitutional. According to the opinion, EEOC’s prior interpretations contemplate liability based on disproportionately adverse effects alone, without regard to an employer’s likely intent, rather than treating disparate impact as an evidentiary mechanism to “smoke out” intentional discrimination. DOJ found that this approach functions as a “qualified racial-proportionality mandate” that places “a racial thumb on the scales, often requiring employers to evaluate the racial outcomes of their policies, and to make decisions based on (because of) those racial outcomes.” The opinion fulfills one mandate of Executive Order 14281, which rejected disparate-impact liability insofar as it “creates a near insurmountable presumption that unlawful discrimination exists wherever there are any differences in outcomes among different [demographic groups].”
Client Alert | 4 min read | 06.12.26
Auto Dealers: The FTC Is Back in the Driver’s Seat — Warning Letters Signal Renewed Federal Scrutiny
Client Alert | 13 min read | 06.12.26
Client Alert | 4 min read | 06.12.26
