On October 3, 2023, the Federal Acquisition Regulation (FAR) Council released two eagerly anticipated proposed rules for federal contractor cybersecurity. This action derives directly from the Biden Administration’s May 2021 Cybersecurity Executive Order (Executive Order 14028). These proposed rules pertain to Cyber Threat and Incident Reporting and Information Sharing (FAR Case 2021-017) and the Standardization of Cybersecurity Requirements for Unclassified Federal Information Systems (FAR Case 2021-019).
One can find the details of the regulations at JD Supra – Two New Cybersecurity Proposed Rules.
Legal professionals, especially those representing federal contractors, must pay close attention to these proposed rules. The Cyber Threat and Incident Reporting rule would require contractors to swiftly share cyber incident details with the government. As for the proposed Standardization of Cybersecurity Requirements rule, it seeks to establish uniform cybersecurity standards for federal information systems.
- The proposed rules, in essence, indicate an elevated sense of urgency and the government’s renewed focus on cybersecurity.
- They typify an attempt at dealing with the evolving complexity and the continuously escalating risks associated with cyber threats.
- The provisions could trigger significant modifications in federal contractors’ approach to cybersecurity, including revamps to their technical systems and likely policy adjustments.
The comment period for both rules is open at present. As such, corporations, legal practitioners, and relevant stakeholders should consider offering their inputs and assessments.
This action, indeed, signals a profound shift in cybersecurity norms for federal contractors. These regulations could well affect the risk management strategies and contractual obligations of all parties involved. Thus, a thorough understanding of these proposed rules is crucial for legal professionals in the sector.