Federal Contractors Face Strict New Cybersecurity Mandates to Safeguard Data

Federal Contractors Face Strict New Cybersecurity Mandates to Safeguard Data

Summary

• New rules: The U.S. federal government has introduced stricter cybersecurity requirements for contractors.
• Compliance Required: Contractors must meet the requirements to win and keep contracts.
• Focus on Data Protection: The rules aim to protect government and citizen data.
• Industry Response: Contractors and security specialists have mixed views.

What is changing

The U.S. federal government has rolled out new cybersecurity requirements that contractors must follow, meant to keep government data confidential and intact. Attackers have often gone after contractors as a side door into government information. The push is overdue.

The new requirements

The mandates set out a framework contractors must put in place. Prevention is only half of it; contractors also have to show they can respond well when a breach happens.

A single standard for all contractors also closes gaps that attackers exploit when security varies from one company to the next.

Key parts of the mandates

The main requirements include:

• Continuous Monitoring: Contractors must regularly monitor and report on their security practices.
• Encryption: Data must be encrypted in storage and in transit.
• Incident Response Plan: A tested plan must be ready for handling breaches.
• Employee Training: Staff must be trained to handle government information securely.

Together, these measures make contractors harder targets for attacks aimed at federal systems.

Industry reaction

Reaction is mixed. Some contractors welcome the clarity. Others worry about cost, and small and medium-sized businesses in particular fear that meeting the standards will take money and staff they simply do not have on hand today.

Without help for smaller firms, the rules could shut out partners the government relies on.

What to watch

Contractors now have to catch up quickly, which means spending on security tools, training and staff.

Watch for compliance deadlines, any support programs for small businesses and how strictly agencies enforce the rules.

Other industries may borrow the approach.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.