The global tech trade association Information Technology Industry Council has recommended that government contractors be given a 72-hour reporting window and a significance threshold on cybersecurity incidents involving controlled unclassified information, or CUI. Policymakers should adopt consistent requirements and strategic assessments on the government’s CUI guardrails, ITI said Monday.
The reporting timeframe is one of ITI’s suggestions following a Federal Register announcement on a request for public comments on proposed amendments to the Federal Acquisition Regulation on contractor compliance obligations in safeguarding CUI. The Department of Defense, NASA and the General Services Administration initiated the public comments solicitation.
Consistency Measures in CUI Management
ITI’s other recommendations on the FAR amendments include certification processes alignment across all federal agencies to ensure consistent CUI management and establishing reasonable cutoff levels for contractor liability risk.
The trade group also suggested in the 10-page comments it submitted that FAR should centralize reporting for shared services to prevent overclassification. In addition, it recommended the standardization of CUI management training to prevent inconsistencies between agencies.
Actionable Reports Needed
Leopold Wildenauer, ITI director of cybersecurity and supply chain policy, described as “fragmented and duplicative” the current cyber incident reporting policies, and noted that policymakers need to focus on aligning them across federal agencies.
“By granting contractors a 72-hour reporting window and establishing a significance threshold, the government can ensure that incident reports are both actionable and meaningful,” Wildenauer stressed.
To support the development of cybersecurity incident reporting policies, ITI has formulated and released two templates: Policy Principles for Security Incident Reporting in the U.S. and Global Policy Principles for Cybersecurity Incident Reporting.
