FAR Case 2021-017, Federal Acquisition Regulation: Cyber Threat and Incident Reporting and Information Sharing
ProposedFAR Council · Proposed rule · October 3, 2023
Summary
Would require contractors to report security incidents involving information and communications technology to CISA within eight hours of discovery and update every 72 hours, keep software bills of materials, and give CISA access for incident response.
What FedXchange has recorded
No changes recorded. The watch records a new document and any change in its status.
- Issuer
- Federal Acquisition Regulatory Council (FAR Council)
- Type
- Proposed rule
- Number
- FAR Case 2021-017
- Issued
- October 3, 2023
- Status
- Proposed
A proposed rule or draft. It may change before it takes effect.
Comments closed February 2, 2024; the FAR Council's 2026 regulatory agenda lists a final rule as pending.
Get new governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.