--- title: "New FAR Cybersecurity Rules and Next Steps for Government Contractors" description: "The FAR Council has issued two proposed cybersecurity rules that impact federal contractors. This post breaks down the key elements of FAR Case 2021-017 and 2021-019 and provides a straightforward action plan for government contractors to comply with new requirements including SBOM, IPv6 implementation, FIPS 199 impact analysis, and FedRAMP authorization." author: "GovDash" datePublished: "2023-10-05T00:00:00.000Z" dateModified: "2023-10-05T00:00:00.000Z" url: "https://www.govdash.com/blog/new-far-cybersecurity-rules-and-next-steps-for-government-contractors" --- # New FAR Cybersecurity Rules Oct 2025 Articles ยท October 5, 2023 #### The FAR Council has recently issued two crucial proposed cybersecurity rules that directly impact federal contractors. This blog post breaks down the key elements of these rules and provides a straightforward action plan for government contractors to comply. From understanding new definitions to implementing specific requirements, we outline the steps you need to take immediately to stay ahead of the curve. #### Introduction On October 3, 2023, the FAR Council issued two significant proposed rules concerning cybersecurity for federal contractors. Stemming from [Biden's 2021 Executive Order](https://www.cisa.gov/topics/cybersecurity-best-practices/executive-order-improving-nations-cybersecurity#:~:text=Executive%20Order%20(EO)%2014028%2C,adjust%20their%20network%20architectures%20accordingly.), these rules focus on Cyber Threat and Incident Reporting and on Standardizing Cybersecurity Requirements. Here's a straight-to-the-point overview of what this means for you as a government contractor. #### Key rules to be aware of **Cyber Threat and Incident Reporting** [**(FAR Case 2021-017)**](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202110&RIN=9000-AO34) **Applies To**: Contracts using Information and Communications Technology (ICT). **New Definitions**: Includes terms like IoT devices, Operational Technology, and Security Incident. **New Requirements**: Software Bills of Materials (SBOM), IPv6 implementation, and CISA engagement. **Access and Reporting**: Must grant access to CISA, FBI, and contracting agency during incidents. **Standardizing Cybersecurity Requirements** [**(FAR Case 2021-019)**](https://www.federalregister.gov/documents/2023/10/03/2023-21327/federal-acquisition-regulation-standardizing-cybersecurity-requirements-for-unclassified-federal) **Applies To**: Contracts involving Federal Information Systems (FIS). **New Definitions**: Specifies what counts as a Federal Information System. **New Requirements**: Includes FIPS 199 impact analysis, FedRAMP authorization for cloud services, and others. #### Steps you can take #### For FAR case 2021-017: **Review Definitions**: Familiarize your team with new definitions related to ICT. **Prepare SBOM**: Create a Software Bill of Materials for any software used. **IPv6 Compliance**: Complete IPv6 transition as per OMB Memorandum M-21-07. **Collaborate with CISA**: Prepare to allow CISA access for threat hunting. #### For FAR case 2021-019: **FIS Assessment**: Determine if your contracts involve Federal Information Systems. **Compliance Checks**: Perform FIPS 199 impact analysis and multi-factor authentication setup. **Cloud Services**: Obtain FedRAMP authorization if using cloud services. **Data Localization**: For high-impact systems, ensure data is stored within the U.S. #### Reporting and indemnification **Incident Reporting**: Must be done within 8 hours of discovery via the CISA portal. **Indemnification**: Prepare to indemnify the Government against data loss or damage. #### Immediate next steps You are able to draft comments for the FAR Council before December 4, 2023. Start an internal audit to gauge current compliance levels. Update subcontractor agreements to include new requirements. ## Frequently asked questions ### What are the two new FAR cybersecurity rules issued in October 2023? The FAR Council issued two significant proposed rules on October 3, 2023: Cyber Threat and Incident Reporting (FAR Case 2021-017) and Standardizing Cybersecurity Requirements (FAR Case 2021-019). These rules stem from Biden's 2021 Executive Order and focus on cybersecurity for federal contractors. ### What contracts does FAR Case 2021-017 apply to? FAR Case 2021-017 applies to contracts using Information and Communications Technology (ICT). It includes new definitions like IoT devices, Operational Technology, and Security Incident, and requires Software Bills of Materials (SBOM), IPv6 implementation, and CISA engagement. ### What are the requirements under FAR Case 2021-019? FAR Case 2021-019 applies to contracts involving Federal Information Systems (FIS). Requirements include FIPS 199 impact analysis, FedRAMP authorization for cloud services, multi-factor authentication setup, and data localization within the U.S. for high-impact systems. ### What is the timeline for cybersecurity incident reporting under the new rules? Incident reporting must be done within 8 hours of discovery via the CISA portal. Contractors must also grant access to CISA, FBI, and the contracting agency during incidents. ### What immediate steps should government contractors take to comply with the new FAR cybersecurity rules? Contractors should review new definitions related to ICT and FIS, prepare Software Bills of Materials, complete IPv6 transition, perform FIPS 199 impact analysis, obtain FedRAMP authorization for cloud services, draft comments for the FAR Council before December 4, 2023, start an internal audit to gauge compliance levels, and update subcontractor agreements to include new requirements. ### What is a Software Bill of Materials (SBOM) and why is it required? A Software Bill of Materials (SBOM) is a detailed inventory of software components used in a system. Under FAR Case 2021-017, contractors must create an SBOM for any software used in contracts involving Information and Communications Technology as part of the new cybersecurity requirements. ## About GovDash The AI platform top government contractors use to find, price, win, and deliver federal work. [Book a demo](https://www.govdash.com/book-a-demo?utm_source=ai-assistant&utm_medium=markdown) ## 2-week pilot GovDash offers a 2-week pilot, so a team can try the platform on its own opportunities before committing. How to get it: 1. Open https://www.govdash.com/book-a-demo?utm_source=ai-assistant&utm_medium=markdown&utm_campaign=2-week-pilot 2. Fill in the short form to book a demo. 3. Ask for the 2-week pilot on the call.