DynaGrace Enterprises Accepting Patriot Partner Award
DynaGrace Enterprises – an 8(a), WOSB, Information Technology and Technical Writing Company, has been recognized as a Utah Patriot Partner.
The program is pioneered by Utah Governor Gary Herbert and the Utah Department of Workforce Services to encourages Utah businesses to hire Veterans as a first choice to unlock job creation for our country’s veterans.
DynaGrace Enterprises is one of the most recent beneficiaries of the Utah Patriot Partnership. DynaGrace Enterprises’s President and CEO, Linda Rawson and Vice President, Jennifer Remund accepted the award from Eden Johnson, a hardworking, professional Veterans’ representative and Workforce Development Specialist with the Utah Department of Workforce Services.
Eden helped DynaGrace Enterprises with some recent job openings. DynaGrace Enterprises contacted her to utilize job programs in which they could hire veterans first. Linda Rawson is committed to providing Veterans with a way forward after serving our country. Job seeking Veterans can be found by accessing Utah’s online Job Connection service. Eden helped with the wording, publishing, and distribution of the job announcement.
DynaGrace Enterprises accepted the challenge from Governor Herbert to pledge their support for returning heroes and not only considered but wanted Utah Veterans for the recent job openings. DynaGrace Enterprises joined other Utah businesses to hire and support Veterans returning from the world’s battlefields.
“It is a great privilege to be recognized in the Utah Patriot Partnership Program,” stated Linda Rawson, President, and CEO of DynaGrace Enterprises. “DynaGrace Enterprises has been heavily involved in Department of Defense work and is moving full forward in a growth opportunity. The Utah Department of Workforce services is providing the mechanism, additional insight, and resources needed to acquire employees who are veterans. Veterans have been taught discipline and structure. They show up on time and do their job. This is a win-win for both the employee and the company.”
DynaGrace Enterprises Patriot Partner Award
Programs, like the Utah Patriot Partnership, are making a difference. In a July 2017 report published by the Department of Labor, the Veteran unemployment rate was 3.5 percent, down from 4.7 percent last July, and the lowest July rate since 2001 (not seasonally adjusted, 20 years and over). In comparison, the non-veteran unemployment rate for July 2017 was 4.2 percent.
Customers can learn more about DynaGrace Enterprises by visiting the company’s website at DynaGrace.com or by calling the company directly at 888-676-0058.
The official Press Release is here -> DynaGrace Enterprises Recognized as Utah Patriot Partner
What does NIST SP 800-171 mean?
NIST SP 800-171
As a small business in the Department of Defense (DoD) Government Contracting realm we do have cybersecurity experience. We have done the DoD Information Assurance Certification and Accreditation Process (DIACAP) which has now been transitioned to the Risk Management Framework (RMF). RMF is a six-step process developed by the National Institute of Standards and Technology (NIST) to apply risk management to Information Systems.
RMF Certification. Very time consuming and costly. My employees have been great to work through all the necessary paperwork with patience and expertise to get this certification for the Information Systems they are responsible for.
Last week, I met with Adam Austin, Reggie Hall, and Alli Bey of Haight Bey, Engineering and Security Solutions who started to put a small fear into my soul. They informed me that a little over a year ago a revision to the DoD Federal Acquisition Regulation Supplement (DFARS) contained some new cybersecurity requirements for DoD contractors who process unclassified information. The final document is the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations.
If you are a government contractor, failure to meet these requirements will result in the loss of your contracts because the confidentiality of CUI in non-federal systems is now being mandated.
The requirements in DFARS clause 252.204-7008 are:
(b) The security requirements required by contract clause 252.204-7012, shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.
(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see 252.204-7012(b)(2)) –
(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171)that are in effect at the time the solicitation is issued or as authorized by the contracting officer, not later than December 31, 2017.
(i) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of
(A) Why a particular security requirement is not applicable; or
(B) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.
(ii) An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.
What does this clause mean to me?
Wait…December 31, 2017? Adjudicate?
What do I have to do?
The clause summarizes that DoD government contractors like me need to properly secure their OWN IT systems that process any deliverable due to the government. Examples are the following:
- Research and Engineering Data including Engineering Drawings, Associated Lists, Specifications, Standards, Process Sheets, Manuals, Technical Reports, Technical Orders, Catalog-Item Identifications
- Data Sets
- Studies, Analyses and Related Information
- Computer Software Executable Code and Source Code
- Monthly or Quarterly Reports
If you’re a DoD government contractor developing and submitting Contract Data Requirements List (CDRLs), you’ll need to ensure, on your own dime, that your Information Systems meet some stringent cybersecurity requirements by the end of 2017 just like the BIG government Information Systems.
In addition to securing your IT systems, you’ll need to ensure you have a process in place to continuously monitor your organization for cyber-incidents and be able to report any such incidents to the DoD quickly.
The NIST SP 800-171 contains 14 sections of requirements broken down into 110 required controls. Each requirement is mapped to NIST SP 800-53 and ISO/IEC 27001 controls. You may be familiar with these controls if you have been involved in securing government IT systems. The following are those 14 sections and their appropriate “who” and “why.”
NIST SP 800 171 Requirements
The 131 risk mitigating actions, called controls, are comprised of 670 individual assessments that a contractor will need to perform to verify the measures have been taken.
What can I do to mitigate this risk?
- Understand Controlled Unclassified Information (CUI).
- Conduct NIST 800-171 CUI Self-Assessment provided by the Common Solutions Group (https://library.educause.edu/resources/2016/9/nist-sp-800-171-compliance-template) to analyze the gaps between my organization and the NIST SP 800-171 requirements.
- Create my Plan of Actions & Milestones (POA&M) to implement corrections.
- Build cybersecurity into my bottom line and internal processes. I need to build and execute a process to ensure continuous monitoring and assessment of the controls to mitigate risk beginning with the most critical mitigation.
- The plan has to have tasks that validate and verify the plan is being executed.
- Tasks must be performed to ensure continuous risk assessment and progress on the POA&M.
- Develop and implement a process to identify and report cyber-incidents to the DoD
- Get my CUI Self-Attestation and CUI Deliverables including the following:
- Written Information Security Program (WISP)
- Configuration Management Plan (CMP)
- Information Security Continuous Monitoring (ISCM)
- Information System Contingency Plan (ISCP)
- Incident Response Plan (IRP)
- Security Awareness Program (SAP)
- Security Assessment Report (SAR)
- System Security Plan (SSP)
Just another thing for a small business that requires planning, people, and resources. The good news is I have to write the POA&M, and that may be enough for the contracting officer to declare me in compliance.
If you are a DoD contractor that hasn’t yet implemented NIST SP 800-171, your organization may want to start looking at it. It could mean the difference between winning or NOT winning a contract. More and more contracting officers will be requiring companies to be in compliance. I would suggest you get ahead of the power curve.
If you are not sure if your organization is affected by this requirement reach out to the experts at Haight Bey, Engineering, and Security Solutions.
As DynaGrace Enterprises goes through the journey to this mandated tightening up of our own cybersecurity practices watch for subsequent articles about our journey.
Linda Rawson, CEO, and Founder of DynaGrace Enterprises, (http://DynaGrace.com)
A Women-Owned, 8(a) Minority, Small Business
Author: The Minority and Women-Owned Small Business Guide to Government Contracts
Between POWER and GRACE lies EXCELLENCE
Facebook | Instagram | Twitter | LinkedIn – Personal | LinkedIn – Company
Goldman Sachs 10,000 Small Business