1
Are your company information systems compliant with the requirements of FAR 52.204-21 “Basic Safeguarding of Covered Contractor Information Systems”? Note: To be compliant, the FAR controls must be fully implemented. The requirements cannot be met with a Plan of Action and Milestone (POAM). *
Select an answer
Yes No N/A
2
Are these systems compliant with the requirements of DFARS 252.204-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting,” including use of external cloud service providers that meet the security requirements equivalent to those established by the Government for Federal Risk and Authorization Management Program (FedRAMP) moderate baseline? *
Select an answer
Yes No N/A
3
Have all 110 controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev 2 been implemented on the information systems? *
Select an answer
Yes No N/A
4
If 3 is answered “No,” is your information system operating under a Plan of Action and Milestones (POAM)? *
Select an answer
Yes No N/A
(ii) Have all 31 Basic Security Requirement controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (Revision 2) been implemented into the information system? *
Select an answer
Yes No N/A
(iii) Have 100 or more controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (revision 2) been implemented into the information System? *
Select an answer
Yes No N/A
5
Does your company currently hold a Medium Level of Assurance (MLOA) Certificate to access DoD Cyber Crime Center (DC3) portal for cyber incident reporting as required by 252.204-7012(c)(3)? *
Select an answer
Yes No N/A
See https://www.dc3.mil/missions/dib-cybersecurity/dib-cybersecurity-dcise/ for details on cyber incident reporting.
6
Is your company compliant with the requirements of DFARS 252.204-7019 and DFARS 252.204-7020 “NIST SP 800-171 DoD Assessment Requirements”? Compliance requires the usage of the DoD Assessment Methodology, with submitted resulting scores to the Department of Defense website “Supplier Performance Rating System (SPRS). *
Select an answer
Yes No N/A
If “Yes” to question 6, please provide:
(i) Self-assessment or Defense Industrial Base Cyber Security Assessment Center (DIBCAC):
Select an answer
Self DIBCAC
Self DIBCAC
(iii) If “DIBCAC”, what level assessment? Medium High
Select an answer
Medium High