Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a defense contractor? What defines an intrusion (or penetration as they call it)? What is required to reported to who?

I was asking because I was curious and wondered how it would affect the community at large. In general I'm a proponent of more sharing among the good guys and wondered how far reaching this would be. My experience has been that most companies dislike confessing to intrusions yet I'd be shocked of any company that hasn't had an intrusion of some sort (or at least an attempt).

If the definition of contractor is narrow (eg companies defined as members of the Defense Industrial Base and penetration is defined as access to Top Secret documents) it will have less an impact than if it more broad (eg companies are any companies with gov contracts, and penetrations are any outside access to any system).

The act itself is vague and I'm asking if anybody knows more about what is intended. I presume the law did not come out of this air and there is a back story as to what caused it and what is intended.

share|improve this question
6  
If you don't have a contract with a US Government Agency then your not a defense contractor. If you have a contract with the agency then ask the government's contracting officer how this new law will effect you. – Ramhound Jan 9 at 15:13
@Ramhound - does your comment mean that who is affected and what they need to report is 'need to know' and the general public is not allowed to know? – Duncan Jan 10 at 12:42
2  
Of course I am not saying that. I am saying if you could be affected by this law then you already know you might be affected and your contracting officer can help determine what needs to be done exactly. When dealing with contracts with the government who you talk to about what is important. While you might be interested in the details the law itself will present those guidelines. I can tell you that in a case like this a company would have to report any possible intrusion into their network. – Ramhound Jan 10 at 12:50
@Ramhound "then you already know you might be affected" - I'm guessing you don't have much dealing with DoD if you think a law will make from passing thru DoD process, to affected contractors, thru the contracting office, and to affected employees, all in less than a month. :-) I was asking here since the 'buzz' generally is faster than the official channels since here the i's don't need dotting. I'm not asking if I'm affected - I'm asking wrt affect on community. – Duncan Jan 10 at 13:14
When I make a statement like "then you already know you might be affected" it means you know you have a contract with the government. Thats the only thing I meant by that statement. I am very familar with the process of dealing with both the government contracter and the contracting officer. – Ramhound Jan 10 at 13:32

closed as off topic by AJ Henderson, Iszi, Gilles, Scott Pack, Jeff Ferland♦ Jan 11 at 22:32

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 6 down vote

For a definitive answer, you'll want to look at three sources.

  • This is all set out in the act itself.
  • The Defence Department will be in touch with cleared defence contractors to provide their detailed requirements.
  • As ever, if you need to know if something is legal or not, don't ask random people on the Internet: ask a suitably qualified lawyer who specialises in that area.

Your updated question asks what is the effect of this on the broader InfoSec community. Probably minimal for those to whom the law does not apply. My company does not have to be PCI compliant, so PCI regulation troubles me hardly at all. We do have to be SOX compliant, and that troubles me a great deal. There are already breach disclosure requirements written into various laws (mostly centred around personally identifiable information).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.