Blog Layout

The shifting sands of cybersecurity: DOD’s interim rule further burdens contractors

gov IRG • Aug 28, 2015

Article by  Dentons

 

Key contacts

Phillip R. Seckman
Partner, Denver
D +1 303 634 4338
Email

Erin B. Sheppard
Counsel, Washington, DC
D +1 202 496 7533
Email

Michael J. McGuinn
Senior Managing Associate, Denver
D +1 303 634 4333
Email

 

 

The Department of Defense (DOD) earlier today issued an interim rule, effective immediately, that significantly increases existing cybersecurity requirements for DOD contractors. The requirements in the interim rule,  available here , have broad applicability to DOD contractors at both the prime and subcontract levels, including commercial item and small business contractors. Contractors can expect these requirements to begin showing up in new DOD contracts immediately and should begin taking steps to ensure compliance.

The interim rule contains a number of new and revised DOD cybersecurity requirements. The key issues are summarized below.

Scope of the DOD requirements

The interim rule significantly expands the scope of the prior unclassified controlled technical information (UCTI) clause’s safeguarding and reporting requirements. Whereas the prior UCTI clause applied only to unclassified controlled technical information, the new clause—now titled “Safeguarding Covered Defense Information and Cyber Incident Reporting”—applies more broadly to all “covered defense information.”

“Covered defense information” includes controlled technical information as well as export controlled information, critical information related to operations security and  any other information  marked or otherwise identified in the contract that requires safeguarding under relevant law and policy, including private and proprietary business information.  The interim rule further clarifies that the definition of “controlled technical information” does  not  depend, as it did under the prior UCTI definition, on whether the information “is to be marked” with applicable DOD distribution statements.

This expanded definition, coupled with the clause’s broad flowdown requirement, means that the revised clause requirements likely will apply to virtually all DOD contractors at the prime and subcontract levels. The interim rule also revises Part 212 of the Defense Federal Acquisition Regulation Supplement (DFARS) to clarify that the rule’s requirements are applicable to commercial item contracts and subcontracts.

Security controls

Additionally, internal contractor information systems that contain covered defense information are subject to new safeguarding requirements. The interim rule removes the clause’s previously required security controls from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53. DOD replaces those requirements with the controls from the recently-issued NIST SP 800-171, issued on June 18, 2015, and previously  discussed here.

The National Archives and Records Administration (NARA) in May 2015 issued a proposed rule, discussed here , that would establish a government-wide policy related to the identification and safeguarding of controlled unclassified information. NARA stated in connection with that rule that it intended to promulgate a Federal Acquisition Regulation (FAR) clause that would apply the requirements of NIST SP 800-171 to contractors. The Office of Management and Budget (OMB) likewise recently proposed guidance seeking to require the use of these same NIST SP 800-171 controls on a government-wide basis for internal contractor information systems,  discussed here. DOD’s decision to use the same NIST standards proposed by OMB and NARA is a welcome step to achieve consistency in cybersecurity standards across the federal government.

DOD in the interim rule also creates a new clause, DFARS 252.204-7008, which states that a contractor prior to contract award can provide a written explanation to the government justifying deviations from the NIST SP 800-171 controls. The prior DFARS UCTI clause had a similar provision, although not required pre-award, allowing contractors to provide this written explanation related to the NIST 800-53 controls. Under the interim rule, if seeking a deviation, a contractor must explain: (i) how the company has in place alternative security controls that “compensate for the inability to satisfy a particular requirement” of the NIST SP 800-171 standards or (ii) that a particular control is inapplicable. The new clause likewise clarifies that the contractor may either comply with the NIST SP 800-171 requirements or provide for alternative but equally effective security measures, a determination which must be approved by DOD prior to contract award.

Reporting requirements

The interim rule also expands reporting obligations. The rule requires contractors that discover a cyber incident that affects a covered contractor information system or information contained therein to investigate and report that incident to DOD. As part of its implementation of Section 1632 of the 2015 National Defense Authorization Act, DOD also requires contractors to investigate and report a cyber incident that affects the contractor’s ability to perform “operationally critical support” functions of a contract. Subcontractors are required to report cyber incidents to both the prime contractor and the government, with lower-tier subcontractors required to report cyber incidents up the chain of privity until the prime contractor is reached.

In addition, the rule modifies DFARS 252.204-7012 to permit DOD to release certain contractor information in a number of circumstances, including “to entities with missions that may be affected by such information” and “for national security purposes.” This expands the permissible reasons for sharing included in the prior version of the clause, which had limited the government’s use of contractor information only to “authorized persons for purposes and activities consistent with [the prior UCTI] clause.” Because contractor information now may be disclosed outside the government, contractors should clearly mark information provided to DOD and carefully consider whether particular information should be disclosed in connection with a cyber incident.

The interim rule further establishes DFARS 252.204-7009, Limitation on the Use and Disclosure of Third-Party Contractor Reporting Cyber Incident Information. This clause is required in contracts that involve contractor support for government activities related to safeguarding covered defense information and cyber incident reporting. It imposes nondisclosure obligations on contractors handling reporting information and provides that a contractor’s breach of its nondisclosure obligations may be subject to criminal, civil, administrative and contractual actions brought by the government, or, importantly, by the impacted reporting party.

Cloud computing requirements

And if the foregoing was not enough, the interim rule also contains a number of new requirements relating to the acquisition of cloud computing services. The interim rule adds a new DFARS subpart, 239.76, which formalizes DOD guidance in this area and mandates that DOD may only award contracts for cloud computing services to contractors that have obtained a provisional authority to operate from the Defense Information Systems Agency (DISA). The new subpart requires the inclusion of specifically enumerated government protections in any DOD cloud services purchase order.

The interim rule also establishes two new contract clauses, DFARS 252.239-7009, Representation of the Use of Cloud Computing, and DFARS 252.239-7010, Cloud Computing Services, for use in any acquisition for information technology services. These clauses require contractors to: (i) implement administrative, technical and physical safeguards and controls outlined in DISA’s Cloud Computing Security Requirements guide; (ii) maintain all government data in the United States unless authorized otherwise in writing; and (iii) restrict access to government data. DFARS 252.239-7010 also mandates that contractors report all cyber incidents related to the cloud services provided under the contract and imposes reporting and compliance obligations that parallel the access and investigation cooperation requirements included in the new UCTI clause.

Comments on the interim rule are due by October 26, 2015. Dentons lawyers will continue monitoring key developments in this area. Additionally, starting in the fall of 2015, Dentons lawyers will be presenting on behalf of the Public Contracting Institute a six-part series addressing the detailed compliance requirements and best practices relating to government contracts cybersecurity. More information about the series can be  found here  or by contacting the authors of this client alert.

By Kevin Hoskins and Associates 10 Apr, 2024
(This is a synopsis of the best information that we have found on Section 174 and its impact on Government Contract Research First. Please contact govIRG if you have questions or would like clarification, and we will direct you to the right resources regarding your needs.) Introduction: The enactment of IRC Section 174, mandating the capitalization of specific research and experimental expenses, has sent ripples of concern throughout the business landscape, particularly affecting contract research firms. This legislation has raised critical questions about the deductibility of research-related expenditures and posed challenges for companies reliant on such activities for revenue generation. In this article, we delve into the implications of Section 174 on contract research organizations (CROs) and explore potential strategies for navigating these turbulent waters. Understanding the Shift: Historically, under IRC Section 162, research and experimental expenses were deductible as ordinary and necessary business expenses. However, the recent amendment to Section 174 necessitates the capitalization and amortization of these expenditures over five years. This change has significant ramifications for businesses, particularly those engaged in government contract research activities. The distinction between "expenses" and "expenditures" has become crucial in determining the tax treatment of research-related costs. Challenges Faced by Contract Research Firms: Government contract research firms rely on the immediate deduction of research expenses to maintain profitability and sustain operations. The requirement to capitalize such expenses threatens their financial viability and could potentially hinder their ability to compete in the market. Considering the challenges posed by Section 174, contract research firms must carefully evaluate their options and adopt proactive strategies to mitigate risks and ensure continued viability. Here are three potential approaches: 1. Compliance with Section 174: One option is to adhere strictly to the provisions of Section 174 by capitalizing all research and experimental expenditures. While this may appear to be the safest choice from a compliance perspective, it could impose significant financial burdens on businesses, potentially impeding growth and expansion efforts. 2. Strategic Non-compliance: Alternatively, some firms may choose to disregard the rules outlined in Section 174, banking on the expectation that legislative amendments will retroactively address the issue. However, this approach carries inherent risks and uncertainty, as it relies on the anticipation of future regulatory changes. 3. Leveraging Section 162: A more nuanced approach involves leveraging the provisions of Section 162 to continue deducting research costs directly related to revenue-generating projects. By categorizing research expenses as ordinary and necessary business expenses, firms can mitigate the adverse effects of Section 174 while maintaining tax compliance. Consultation and Disclosure: Regardless of the chosen strategy, government contract research firms are advised to seek guidance from tax advisors to assess the implications of Section 174 on their specific circumstances. Additionally, attaching an IRS Form 8275 Disclosure Statement to tax returns can provide protection against potential penalties associated with non-compliance with Section 174. This statement should clearly articulate the rationale behind the chosen tax treatment and demonstrate adherence to applicable tax laws. Conclusion: The implementation of IRC Section 174 has introduced unprecedented challenges for government contract research firms, threatening their financial stability and operational efficiency. In navigating the complexities of this regulatory landscape, proactive planning and strategic decision-making are paramount. By carefully assessing their options and seeking expert guidance, contract research firms can adapt to the new tax regime while safeguarding their long-term viability and competitiveness in the marketplace. References: Jim Casart, Co-Founder of the GovCon Alliance Rick Kleban, Founder and President of Sycamore Growth Group James Bean, Senior Research Analyst at Sycamore Growth Group
By Kevin Hoskins 08 Mar, 2024
What is an SF1408? The Standard Form 1408, or SF1408, also known as the Pre-Award Survey of Prospective Contractor (Accounting System), is a document used by the U.S. Government to determine the acceptability of an accounting system for prospective government contracts. The form consists of two main sections the first used for describing the accounting systems features and responsibilities, and the second section evaluating the accounting system. Brief Explanation of the SF1408 Sections Section I of the SF1408 encompasses a recommendation section, outlining crucial elements such as the Statement of Acceptability, which indicates the suitability of the accounting system, followed by a Narrative. The narrative should be used to give an accounting system the ability to detail the system's features and functionality along with its clarifications of deficiencies. It also includes information on who conducted the survey and the reviewing official responsible for assessing the system. In Section II, the Evaluation Checklist delves into specific criteria to evaluate the accounting system. It begins by assessing if the system adheres to acceptable accounting principles. Then, it scrutinizes various attributes such as the segregation of direct and indirect costs, proper identification and accumulation of costs, as well as the presence of essential components like a timekeeping and labor distribution system. Additionally, the checklist evaluates whether the system provides requisite financial information mandated by FAR (Federal Acquisition Regulation) requirements and contract clauses, including support for progress payments. Furthermore, it considers the system's reliability, scalability, and operational status. Through these comprehensive evaluations, the SF1408 aims to ensure the accounting system's compliance and effectiveness in meeting contractual and regulatory requirements. Example of Section 1.2 Narrative The accounting system consists of the General Ledger with its chart of accounts (COA) plus reports as provided within the accounting system framework. Accounting systems include a variety of reports such as basic financial statements, basic job cost reports, and a variety of reports for transactions and labor reporting. The General Ledger system in an accounting system is the primary book of record and all other reports are derived and reconciled to this record. An accounting system, includes labor distributions to single cost objectives whether direct or indirect costs, calculation of monthly and year to date rates, application of the indirect rates to the jobs, monitoring of the status of funding and costs for each job on an inception to date basis, plus an analysis of revenue. The system can generate Cost Plus, T&M, and Fixed Price contract invoices. The Accrual basis of accounting is used in accordance with Generally Accepted Accounting Principles (GAAP). Costs input into the system are evaluated to determine if the costs are allocable, allowable and reasonable. In compliance with FAR 31, costs related to specific jobs are charged to the applicable jobs and related direct cost accounts. Unallowable costs are recorded in the unallowable accounts. Unallowable costs may be charged to a particular job if they are specifically caused by or benefit a specific job, but the amounts are not billable (this also allows full disclosure of ALL costs to a project). Indirect rates are calculated monthly to compare actual rates versus proposed/billing rates and the charges are allocated in the General ledger and are allocated to specific jobs. The monthly preparation of Job Cost Reports allows for interim determination of costs to contracts. Unallowable costs are separately recorded and are not billed (directly or indirectly) according to FAR 31 and the procedure on reviewing unallowable costs. Labor charges are recorded on timesheets which require identification of job and hours worked, signature, and approval. The labor hours are input into the accounting system Timesheet system. This allows the charging of appropriate jobs and calculation of charges. The actual distribution of hours and dollars to direct accounts, indirect accounts and unallowable accounts and related jobs occurs real time and a labor distribution is completed each month and posted to the general ledger. Timecards are currently in use by all employees. While the company supports 40 hours per week, some situations will require additional effort. All hours worked are recorded. In the case of an hourly (Fair Labor Standards Act (FLSA) – non-exempt) employee all hours are compensated including overtime premium for hours in excess of 40 hours per week. For salaried (FLSA – exempt employees) the system calculates an effective rate and applies that across all hours worked by the employee in compliance with Defense Contract Audit Manual (DCAM) 6-410.4(a). Vendor Invoices received are evaluated to determine the allocability, allowability and reasonability of each charge. Based on this review, charges are appropriately charged to direct, indirect, unallowable and appropriate jobs. Invoices are paid in the normal course of business, generally within 30 days. Jobs can be established to coincide with requirements for Task/Subtask or Contract Line Item (CLIN) accounting. Likewise, Jobs can be established to differentiate between preproduction and production costs. Since the Jobs are based on and reconciled to the General Ledger the costs can be summarized or detailed as necessary to allow for review and determination of follow-on contract pricing. The system can provide data to support progress payments/public vouchers. From the details of the General Ledger and the calculations on the job cost reports, plus the other related controls regarding payment of expenses and exclusion of unallowable costs, billings can be readily prepared and reconciled. Billings are submitted based on the terms of the contract based on incurred costs to the projects, Cost, Plus, T&M invoices, or Fixed Price contracts. Each project is given a project number. The hours each employee spends on each project are entered into the accounting system Time & Expense time tracking system daily. This data is monitored for accuracy, and the audit trail is reviewed to verify no improprieties or errors have occurred. Each employee’s supervisor, or designee, approves the data entered by their direct reports. At the end of each week, the time that has been entered is used to generate time sheet reports which are verified to be accurate by accounting. Other Direct Charges (ODCs) such as travel, and materials expenses are entered into the accounting system as they are incurred and paid. A copy of all supporting documentation for material purchases and travel for each specific project is collected as well. Minimum of 2 quotes for all material purchases. The travel expenses are reviewed for compliance with the requirements of the contract. Most follow the requirements of FAR 31.205-46(a)(2) with guidance listed in the Joint Travel Regulations (JTR). Each trip must have a travel approval form signed by supervisor/Program Manager, if possible two weeks in advance of the trip. These forms are cross referenced with the expense reports to make sure all locations, dates, and project numbers match before being processed for reimbursement. Customer approvals for trips may be required before those travel costs can be included with the Invoice. Each employee is given specific information on the per diem rules in the Employee manual and can be found in the GSA website for most trips rules and must have written approval for any costs that go over the per diem rate when it is not available. The material purchases and travel expenses for each specific project are verified against the corresponding accounts in the accounting system General Ledger and Job Costing Journal. FAR 31.2 Unallowable costs are entered into segregated accounts and are excluded in the calculation of indirect rates and excluded from client billings. All subcontractor invoices are checked against the subcontract documentation package for accuracy and to ensure that no limits have been exceeded. If issues are found, the subcontractor is contacted, and the issue is resolved before the invoice is submitted for billing When a Subcontractor submits a bill, it is immediately checked for accuracy in labor, fee, rates, and period of performance and compliance with the terms of the contract including invoicing and payment conditions, allowable versus unallowable expenses, fees and other contract flow-down clauses. Depending on the CDRLs and reporting required by the main contract, backup documentation for ODC charges included in a subcontractor invoice may be required. If the bill is found to be complete and correct, it is then entered into the Accounts Payable system. The Accounting Department keeps track of the monthly status of tasks having subcontractors so that the combined amount to be billed by both the subcontractors and company remains under the overall contract limits. If applicable, Invoices are generated based only on information entered in the accounting, including interim public vouchers. Invoices are generated using DCAA –approved provisional Contractor and Government site overhead rates and General and Administrative rate are applied to the direct labor and other direct costs for cost plus fixed fee task orders. Vouchers are generated and verified to be correct. The vouchers are then submitted to the Government or other Paying Agency either electronically or by mail, as required. Any individuals responsible for the preparation of public vouchers are trained. These individuals receive hands-on training by preparing vouchers that are reviewed by accounting for accuracy and completeness. Periodic training is provided to our accounting department staff to reinforce the initial training and provide updates on changing rules and regulations. Accounting will oversee the provisional billing rate adjustments. The spot rate and projected actual rates will be monitored monthly. This status is reported to management each month. If management determines there is a material difference between provisional rates and the forecasted actual rates, then a change in provisional rates will be submitted to DCAA when applicable. Provisional rates can never be changed without written permission by DCAA. Direct Contract Costs Costs incurred in performing contract work that can be directly associated with a given contract and task are charged to a separate charge number (final cost objective) established in the job costing system. Direct costs consist of direct labor and other direct costs such as travel, or equipment purchases. Employees must charge to a direct contract if the task given can be identified to that single cost objective which is in accordance with FAR 31.202 Direct Costs. Indirect Contract Costs Costs that cannot be directly associated with a given contract and task are charged into one of the indirect final cost pools: Company Overhead pool or General and Administrative pool. Using the bases described below, indirect cost rates are computed and are then used to allocate the costs to contracts. Company Indirect Cost Pool All expenses that are related to contract performance on contracts that are performed at the Company, but that cannot be reasonably related to a specific contract or task are charged to the Company Overhead Cost Pool. These expenses include, but are not limited to, company-site indirect overhead labor, fringe benefits applied to company-site indirect overhead labor, incentive bonus, training and allocations of the Facility Service Center. Once such costs are collected, they are divided by the base of total company direct labor (includes R&D and B&P as direct labor) and fringe benefits applied to company- direct labor. This calculation yields the Company Overhead rate, which is then applied to company direct labor to determine the amount of company overhead costs that should be applied to each individual contract incurring company direct labor. General and Administrative Cost Pool All expenses that are related to the overall running of the business but that cannot be reasonably related to contract performance, or a specific contract or task, are charged to the General and Administrative Cost Pool. These expenses include, but are not limited to, G&A indirect labor, fringe applied to G&A indirect labor, accounting services, tax services, allowable legal fees, and bank service charges. Once such costs are collected they are divided by the base of the total of company direct labor, company overhead applied to company direct labor, and total other direct costs. Also, included are any applicable unallowable costs. This calculation yields the G&A rate which is then applied to the company direct labor. Total Cost Input or “TCI”) is used to determine the amount of G&A costs that should be applied to each individual contract. Note: The information of an SF 1408 can be someway embedded in your proposal when you receive it. Often times, it is in the schedule L of the RFP. GovIRG is here to help you in any way we can!
By Kevin Hoskins 08 Dec, 2023
In the intricate landscape of government contracting, selecting the right Enterprise Resource Planning (ERP) system stands as a pivotal decision. The choice not only impacts operational efficiency but also dictates compliance adherence and data security. Here are ten vital considerations when embarking on this crucial decision-making journey: 1. Compliance with Government Regulations: The ERP system must adhere to stringent government regulations. The seamless alignment with standards is pivotal in the realm of government contracting, where adherence to regulations is paramount. 2. Security and Data Protection: Given the sensitivity of information involved in government contracts, robust security features become non-negotiable. Encryption capabilities and adherence to data protection standards are vital elements. 3. Scalability: As government contracting activities expand, the ERP system must be able to accommodate the increased volume of transactions, users, and data without compromising performance. 4. Integration Capabilities: Seamless integration with various systems and applications is imperative. Real-time data flow across financial management, project management, and procurement systems enhances operational efficiency. 5. Customization and Flexibility: The ability to customize the ERP system to adapt to evolving requirements and workflows is crucial. Government contracting processes often vary, necessitating flexibility in configurations. 6. Reporting and Analytics: A robust reporting and analytics module aids in decision-making, compliance reporting, and meeting auditing requirements. Customizable, detailed reports are essential. 7. Audit Trail and Compliance Tracking: Transparency and accountability are indispensable in government contracts. The ERP system must maintain comprehensive records of all transactions and changes to ensure compliance and facilitate audits. 8. User-Friendly Interface: An intuitive interface fosters widespread adoption and efficient utilization of the ERP system. A positive user experience enhances productivity and reduces training time. 9. Vendor Reputation and Support: Choosing a reputable ERP vendor with experience in government contracting is crucial. Research the vendor’s track record, customer reviews, and the level of support they offer to address issues promptly. 10. Cost of Ownership: Evaluating the total cost of ownership, including licensing fees, implementation costs, training expenses, and ongoing maintenance, ensures the system provides value for money and aligns with the organization’s budget. Each of these factors bears significant weight in the decision-making process, shaping an ERP system that aligns seamlessly with the specific demands of government contracting. At govIRG, we understand the intricacies involved in this selection process. Our expertise and tailored solutions can guide you toward making informed decisions that drive the success of your projects and operations. In the labyrinth of ERP choices, the informed selection of a system that resonates with your organization’s unique requisites holds the key to unlocking enhanced efficiency, compliance adherence, and operational success in government contracting.
More Posts
Share by: