Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a revision of the DOD’s information collection request (ICR) for “Safeguarding Covered Defense Information, Cyber Incident Reporting, and Cloud Computing”. The ICR covers Defense Acquisition Regulation Supplement (DFARS) reporting requirements. The revision included decreasing the number of annual responses by 18,214 and decreasing the estimated number of burden hours for the ICR by 2,376.
Change in ICR Burden
The supporting document breaks down the decrease in responses in more detail, noting that there was:
• A decrease in the number of
estimated respondents under DFARS
clause 252.239-7009, Representation of Use of Cloud Computing, from 34,684
to 16,108,
• An increase in the number of
respondents estimated to report cyber incidents under DFARS
clause 252.239-7010, Cloud Computing Services, from 10 to 32; and
• An increase in the number of respondents estimated to report cyber incidents under DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, from 200 to 580.
The first item is not strictly related to cybersecurity, it is merely a requirement to report an intent to use cloud computing resources in support of a DFARS contract. So this ICR is announcing that, based upon recent historical DFARS data, DOD is expecting to see its covered contractors report 612 cybersecurity incidents per year, a 191% increase in the number of expected cyberattacks being reported.
Commentary
That 612 number seems awfully lite considering the ongoing
news reporting (see here,
here
and here
for example) about cyberattacks against defense contractors. Either the news is
blowing things out of proportion (and that is always possible) or contractors
are not reporting according to their DFARS requirements. Or, to be fair, there
is a combination of the two. In any case, perhaps CISA and DOD should investigate
the apparent discrepancy while CISA is trying to formulate their cyber incident
reporting rule. That way, maybe CISA can get more accurate data when their rule
goes into effect.
Posts
