White House Details Draft Contractor Data Breach Rules

Agencies could have a template for data breach contract clauses as early as this fall, according to a detailed draft policy.

Until now, federal standards, White House polices and governmentwide information security laws have offered departments and contractors a jumble of information security regulations from which to choose.

The new proposed provisions for "Improving Cybersecurity Protections in Federal Acquisitions” are meant to ensure government data is kept safe no matter whether it's inside an agency-owned system or a corporate vendor's system. The release, first previewed late last month, still leaves much of the exact language up to each agency's discretion. 

"The proposed guidance will strengthen government agencies’ clauses regarding the type of security controls that apply, notification requirements for when an incident occurs, and the requirements around assessments and monitoring of systems," the draft states. 

Contractors and other members of the public have until Sept. 10 to provide suggestions for changes to the policy. Individuals can either submit comments on the community forum GitHub. After receiving feedback, the White House will issue final guidelines this fall. 

Upon publication, the agency's chief information officer, chief acquisition officer, chief information security officer, senior privacy officer, and other relevant officials "shall immediately begin working together to apply the guidance," the proposal sates. 

If agencies fail to incorporate cyber clauses, the penalty is more carrot than stick. White House officials will sit down with agency leaders in face-to-face meetings, called CyberStat sessions, to discuss network information security lapses and assist them on improvements.  

The proposal follows recently revealed deep hacks into USIS and KeyPoint contractor networks that held investigations on federal employees, as well as a string of data breaches at agency suppliers over the past few years. 

Under the draft rules, contractors need only notify customer agencies of data breaches on company systems if sensitive government data, so-called controlled unclassified information, is affected, "not every cyberincident affecting the contractor system."

The official bible of agency purchasing rules, called the Federal Acquisition Regulation, will be amended "for inclusion of contract clauses that address, as appropriate, the guidance" covered in key sections of the new rules, White House officials said in a statement.

The preliminary policy lists guidelines on incident reporting, assessments of a contractor's information systems and "continuous monitoring" of cybersecurity. 

Agencies will be at liberty to determine the appropriate timeline for contractors to notify specific government officials of incidents

To ensure incidents impacting government data on a contractor's system are reported in a timely fashion all contracts will spell out:

• Language to indicate that a cyber incident that is properly reported by the contractor shall not, but itself, be interpreted as evidence that the contractor has failed to provide adequate information safeguards for [sensitive government data];
• The definition of what constitutes a cyber incident;
• The required timeline for first reporting to the agency;
• The types of information required in a cyber incident report to include: company and point of contact information, contract information, the type of information compromised;
• The contractor shall send only one report to each agency [point of contact] identified in the contracts, not a report for each contract from that agency. The report may contain information required by other agencies, so one report may satisfy the requirements of multiple agencies; and
• Specific government remedies if a contractor fails to report according to the agreed upon contractual language.

Contract wording must allow agency officials to scan a contractor's internal corporate systems periodically or in the event of an emergency.

The agreements must ensure "agencies are granted access for security reviews" for the duration of the contract, the proposal states. "The agency should specify that the contractor will afford the agency access to the contractor’s facilities, installations, operations, documentation, databases, IT systems, devices and personnel used in performance of the contract, regardless of location.”

The Department of Homeland Security currently helps each agency dispatch sensors and technical experts to surveil agency-owned systems around the clock. Under the draft rules, contractor-operated systems must either have continuous monitoring systems in place that meet the same level of security, or the agency can perform "IT security scanning of contractor systems with tools and infrastructure of its choosing."

(Image via wk1003mike/ Shutterstock.com)