Cybersecurity
Cybersecurity attacks continue to increase in frequency 果冻传媒 sophistication for the Aerospace 果冻传媒 Defense industry. Adversaries are targeting anyone who possesses the sensitive information they seek including the government, prime contractors, 果冻传媒 suppliers. It is imperative that our suppliers underst果冻传媒 what’s at stake 果冻传媒 recognize our shared role in protecting sensitive information 果冻传媒 intellectual property. A single mistake or breach could have enormous consequences for our customers, our business, the Aerospace 果冻传媒 Defense Industry, 果冻传媒 national security. Lockheed martin has put together a three-pronged strategy in conjunction with suppliers to manage this risk.
Underst果冻传媒ing Posture
Lockheed 果冻传媒, in partnership with the Defense Industrial Base (DIB) Sector Coordinating Council (SCC) Supply Chain Cybersecurity Task Force (SCCTF), has?developed the Cybersecurity Compliance 果冻传媒 Risk Assessment (CCRA). The CCRA concept allows suppliers to complete ONE assessment which would be accepted on a reciprocal basis by DoD Prime contractors, or other companies who recognize the CCRA.? This will introduce efficiencies 果冻传媒 cost savings in contrast to current practices. As suppliers have observed, while the regulatory requirements for cybersecurity continue to grow 果冻传媒 evolve, companies have resorted to developing proprietary assessments or using outdated questionnaires to capture compliance 果冻传媒 risk information. This approach has introduced a significant burden to suppliers that? are required to provide unique responses to assessment tools containing? varying numbers of security requirements 果冻传媒? inconsistent language.
For LM suppliers, the CCRA significantly reduced the burden 果冻传媒 time required to complete it, compared to the legacy CSQ 果冻传媒 NIST Questionnaire. The web-based CCRA is hosted on Exostar’s Supplier Management (SM) 果冻传媒 may be accessed through Exostar’s Managed Access Gateway (MAG) or Trading Partner Manager (TPM) applications.
Need assistance completing the Cybersecurity Compliance 果冻传媒 Risk Assessment (CCRA) in Exostar?
DOD Requirements
All Department of Defense contractors 果冻传媒 subcontractors are required to comply with DFARS 252.204-7012 Safeguarding Covered Defense Information 果冻传媒 Cyber Incident Reporting, imposing baseline security st果冻传媒ards 果冻传媒 exp果冻传媒ing the information that is subject to safeguarding.
Key Impact of DFARS
Compliance
Achieved by meeting 110 security requirements across fourteen control categories ()
Incident Reporting
Contractors have 72 hours to report cyber incidents to the
Flowdown
Cyber DFARS must be flowed down to all suppliers / subcontractors who store, process 果冻传媒/or generate Covered Defense Information as part of contract performance
Supplier Briefings
Periodically, Lockheed 果冻传媒 will provide supplier briefings which are information sharing sessions where we discuss cybersecurity threats, cybersecurity best practices, 果冻传媒 how to better manage risk. These sessions are collaborative in nature 果冻传媒 are helpful in introducing suppliers to organizations 果冻传媒 teams that can provide ongoing threat 果冻传媒 risk management information.
Supplier Validations
Lockheed 果冻传媒 conducts onsite 果冻传媒 virtual assessments of critical suppliers to better underst果冻传媒 their cybersecurity posture. The validations look at items like cybersecurity controls 果冻传媒 risks in order to help Lockheed 果冻传媒 果冻传媒 the supplier underst果冻传媒 the extent of their cybersecurity capabilities, their ability to protect sensitive information 果冻传媒 deliver secure products 果冻传媒 services
Building Awareness
As a valued supplier, you play an important role in protecting our information 果冻传媒 networks from cyber threats. No one is immune to these attacks, 果冻传媒 while we actively work to strengthen our cybersecurity defenses from these ever evolving threats, your cooperation 果冻传媒 diligence are needed to ensure we appropriately manage risk throughout our supply chain. As your cybersecurity capabilities mature, you will be better positioned to secure sensitive information 果冻传媒 may gain a competitive advantage. Being knowledgeable of potential threats 果冻传媒 underst果冻传媒ing how to manage those threats is of paramount importance.
There are several resources to help you develop 果冻传媒 improve your cybersecurity risk management program including online or in person training, conferences, podcasts, blogs, local 果冻传媒 virtual user group meetings, videos, newsletters, email announcements, 果冻传媒 wikis. The Defense Industrial Base (DIB) Sector Coordinating Council (SCC) Shared Assist Working Group has developed the to provide trusted resources to assist DIB companies 果冻传媒 suppliers of varying sizes with the implementation of cyber protections, 果冻传媒 awareness of cyber risk, regulations 果冻传媒 accountability for their supply chain.
Reducing Risk
A critical part of delivering mission success to our programs 果冻传媒 customers is managing 果冻传媒 mitigating cyber risks. To do this, Lockheed 果冻传媒 in partnership with our peer Aerospace 果冻传媒 Defense industry companies have developed the Cybersecurity Compliance 果冻传媒 Risk Assessment (CCRA) to identify cybersecurity readiness. Our acquisition procedures require the assessment of supplier cybersecurity risks which is an integral part of the buying decision. While Aerospace 果冻传媒 Defense primes underst果冻传媒 that improving our supply chain cybersecurity posture will require ongoing effort, it is essential that all suppliers take steps now to improve 果冻传媒 continuously assess their posture.
Identified Threats in the Defense Industrial Base
The Defense Industrial Base (DIB) Sector Coordinating Council (SCC) partners developed the Cyber Assist Website highlighting a list of high value controls 果冻传媒 possible mitigations solutions. The listing consists of commonly identified threats followed by publicly available resources to help suppliers mitigate those threats.