We recently discussed data security requirements for federal contractors and now we are doing a deeper dive into one of the trickier compliance factors: reporting cyber incidents.
What is a cyber incident?
Federal contractors use and have access to sensitive government data, and as such it is their duty to manage that information responsibly. Data security protocol has changed in the last year to more tightly protect those materials. Federal contractors are now required to rapidly report cyber incidents to the Department of Defense.
The DoD defines a cyber incident as “actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.” Even if the actual government data wasn’t attacked, any breach to a covered contractor information system must be reported so the DoD can assess risk to the information.
Reporting requirements
If you experience a cyber incident as defined above, federal regulation mandates you to report it “rapidly” – defined as within 72 hours of discovery of the breach. Additionally, you need to “conduct a review for evidence of covered defense information,” such as identifying compromised computers, servers, and accounts, as well as identifying exactly which data was breached.
For federal contractors, a network compromise is defined as “disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.” You are required to file a report even if there is only evidence to suggest an attack might have happened. Those attacks can come through an insider to your organization or an outside hacker, whether with malicious intent or through error.
Cyber Incident Prevention + Response
With the complexity of this industry, it is almost inevitable that contractors will experience a cyber incident at some point. Investing in data security tools and creating a response plan are vital elements to any contractor’s business plan. With sensitive data, it is your responsibility to monitor that information for evidence of network attack.
Monitoring software, such as technology created by Veriato, tracks user activity to make sure your data isn’t being accessed by someone who shouldn’t have it, or in a suspicious way. If any behavior is flagged, you can access a factual, comprehensive look at the incident to understand what happened, and prevent future breaches. Additionally, you’ll have a robust report for the DoD, which will build your reputation and prevent negative effects.
Investing in monitoring software as part of your security plan will improve your data protection and help with cyber incident reporting compliance, because you’ll have a better situation assessment within the 72-hour time period
Insider Risk – How Prepared Are You?
Not every company is equally prepared to deal with insider risk. This report outlines the four stages of insider risk maturity and explores how to improve your insider risk preparedness.
About the author
