Uncontrolled Information: DoD Audit Finds Contractor Lapses in Protecting Controlled Unclassified Information
Client Alert | 1 min read | 08.02.19
The Department of Defense Inspector General has released a much-anticipated audit report regarding the protection of Controlled Unclassified Information (CUI) on contractor networks. Begun last summer at the Defense Secretary’s request, the audits found that contractors are not consistently implementing cybersecurity standard NIST SP 800-171, despite being required to do so under DFARS 252.204-7012. The report calls particular attention to common shortcomings regarding multifactor authentication, strong passwords, vulnerability management, and removable media, among others.
The report recommends that DoD:
- Verify that contractors are identifying, responding to, and reporting cyber incidents involving CUI;
- Assess contractors’ ability to protect CUI as part of the solicitation process; and
- Validate, at least annually, that contractors are complying with their contractual cybersecurity requirements.
These recommendations are consistent with recent DoD efforts to establish a “Cybersecurity Maturity Model Certification” that would require contractors to be certified compliant with contractually-specified cybersecurity requirements to be eligible for award.
Contacts
Partner, Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 10 min read | 10.23.25
The EU’s Defense Readiness Roadmap and Omnibus: What are the Implications for Defense Procurement?
On October 16, 2025, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy presented their Defense Readiness Roadmap 2030 to the EU Member States. This comprehensive plan aims to strengthen European defense capabilities. It follows, and should be read together with, the Commission’s Defense Readiness Omnibus that was published in June 2025. The Omnibus contains a set of proposals to facilitate defense investments and boost EU Member States’ responsiveness to today’s security challenges.
Client Alert | 5 min read | 10.22.25
Sixth Circuit Reaffirms Privilege Protections During Internal Investigations
Client Alert | 4 min read | 10.21.25
Pivot Point for 340B: HRSA Rebate Model Pilot Program Approaches Launch
Client Alert | 5 min read | 10.20.25
What’s new for Belgian Construction Contracts under the New Book 7 of the Civil Code
