Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

In response to a series of cyberattacks against the United States and its critical infrastructure, including the <a href="https://www.thompsonhine.com/publications/responding-to-the-solarwinds-breach-compliance-and-oversight-considerations" target="_blank" rel="noopener">SolarWinds breach</a>, President Biden recently issued an executive order on <a href="https://www.govinfo.gov/content/pkg/FR-2021-05-17/pdf/2021-10460.pdf" target="_blank" rel="noopener">Improving the Nation’s Cybersecurity</a> (Cyber EO). The Cyber EO creates several new cyber and data protection requirements that will impact organizations providing, directly or indirectly, cloud services, software solutions, and other information technology to the federal government. Compliance with the Cyber EO, and the resulting changes to the Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS), will significantly influence whether an organization is determined to be a “responsible contractor” as required by FAR Part 9. Some of the Cyber EO’s key issues are set forth below.

contentpilot/introduction

core/heading

A cornerstone of the U.S. government’s cybersecurity policy is to encourage and, in some instances, mandate <a href="https://admin.thompsonhine.com/wp-content/uploads/1137/doc/Steven_G._Stransky.pdf" target="_blank" rel="noopener">cyber threat information sharing</a> between private sector entities and the government. The Cyber EO recognizes that technology-related government contractors “have unique access to and insight into cyber threat and incident information” pertaining to the federal government’s networks and systems, but that government contracts limit the sharing of such data to federal agencies. In turn, the Cyber EO mandates updates to the FAR and DFARS to ensure that government contracts include clauses requiring contractors to collect and preserve data relevant to cybersecurity events, share such data with the agency with which they have contracted and other federal agencies (as may be determined in the future), collaborate with federal agencies as they investigate and respond to cyber incidents, and share cyber threat and incident information with federal agencies.

core/paragraph

The Cyber EO mandates that all information and communications technology contractors report to their contracting agency and certain other federal departments “when they discover a cyber incident involving a software product or service provided to such agencies or involving a support system for a software product or service provided to such agencies.” The Cyber EO requires the FAR and DFARS to be updated to clarify the scope and nature of this reporting. The FAR and DFARS must also address the time periods within which contractors must report cyber incidents based on a graduated scale of severity, with reporting on the most severe cyber incidents to be within three days after initial detection.

A significant portion of the Cyber EO is dedicated to cloud service providers (CSP), the Federal Risk and Authorization Management Program (FedRAMP), and requiring the adoption of a <a href="https://csrc.nist.gov/publications/detail/sp/800-207/final" target="_blank" rel="noopener">zero trust architecture</a> within the federal government. In particular, the Cyber EO requires certain federal agencies to issue a federal cloud security strategy, cloud security technical reference architecture documentation, and a cloud service governance framework. It also requires federal agencies to “establish a framework to collaborate on cybersecurity and incident response activities” related to certain federal cloud technology to “ensure effective information sharing among agencies and between agencies and CSPs.” The Cyber EO also includes requirements addressing automating and standardizing communications between CSPs and federal agencies; automation throughout the FedRAMP lifecycle; digitizing and streamlining compliance documentation; and identifying relevant compliance frameworks, mapping those frameworks into the FedRAMP authorization process, and allowing them to be used as a substitute for the relevant portion of the authorization process.

The Cyber EO includes several technically detailed provisions addressing risks, threats, and new requirements pertaining to the government’s procurement of software. In particular, it notes that the “development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors” and “[t]here is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended.” To address these concerns, the Cyber EO mandates that certain federal agencies, in conjunction with the private sector and academia, identify existing or develop new standards, tools, and best practices for developing and procuring secure software solutions and issue related guidance that addresses, among other issues:

core/list

The Cyber EO also requires that certain agencies more thoroughly examine and define the term “critical software” to which these requirements will apply. In addition, federal agencies must furnish recommendations on amendments to the FAR requiring “suppliers of software available for purchase by agencies to comply with, and attest to complying with, any requirements” that are issued pursuant to the Cyber EO. After such FAR amendments become final, federal agencies must remove software products that do not meet the requirements of the amended FAR from all federal supply schedules, federal government-wide acquisition contracts, blanket purchase agreements, and multiple award contracts. However, the Cyber EO creates separate rules for agencies employing software developed and procured prior to the date of the Cyber EO (i.e., legacy software).

The Cyber EO mandates that certain federal agencies initiate pilot programs (informed by existing consumer product labeling programs) to educate the public on the security capabilities of IoT devices and software development practices; identify IoT cybersecurity criteria for a consumer labeling program; and identify secure software development practices for a consumer software labeling program. The criteria for IoT devices must reflect the levels of testing and assessment that the product may have undergone and be compatible with existing labeling schemes that manufacturers use to inform consumers about the security of their products. The practices for software must consider whether a labeling program may align with any similar existing government programs and reflect a baseline level of secure practices and increasingly comprehensive levels of testing and assessment that the software may have undergone.

It will be important for government contractors to assess the upcoming changes to the FAR and DFARS to ensure they are compliant with these new requirements. Government contractors should also consider participating in the government’s rulemaking process to ensure any new cybersecurity requirements are practical and reasonable in light of the government’s compelling need for greater information protection.

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Mona Adabi 202.263.4147 <a href="mailto:Mona.Adabi@ThompsonHine.com">Mona.Adabi@ThompsonHine.com</a>

Tom Mason 202.263.4168 703.628.0462 <a href="mailto:Tom.Mason@ThompsonHine.com">Tom.Mason@ThompsonHine.com</a>

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

or any member of our <a href="https://www.thompsonhine.com/services/government-contracts-2" target="_blank" rel="noopener">Government Contracts</a> group.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Government_Contracts_Update_-_New_Cyber_EO_-_Issues_for_Government_Contractors_and_the_Private_Sector.pdf

New Cyber EO: Issues for Government Contractors and the Private Sector

Services