FAR Cyber Incident Reporting NPMR to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a Federal Acquisition Regulation notice of proposed rule making for “FAR Case 2021-017, Cyber Threat and Incident Reporting and Information Sharing”. According to the listing in the 2022 Spring Unified Agenda:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to increase the sharing of information about cyber threats and incident information between the Government and certain providers, pursuant to OMB recommendations, in accordance with section 2 (b)-(c), and Department of Homeland Security recommendations, in accordance with section 8(b), of Executive Order 14028, Improving the Nation’s Cybersecurity. In addition, requires certain contractors to report cyber incidents to the Federal Government to facilitate effective cyber incident response and remediation, pursuant to Department of Homeland Security recommendations in accordance with sections 2(g)(i) of Executive Order 14028 [link added].”