Federal Cybersecurity Statutes

Public Law:

114-113

U.S. Code:

Cybersecurity Information Sharing Act of 2015, 6 U.S.C. §§ 1501–1510

Cybersecurity Act of 2015 Short Answer Cybersecurity Act of 2015 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

80-253

U.S. Code:

National Security Act of 1947, 50 U.S.C. §§ 3001 et seq.

National Security Act of 1947 Short Answer National Security Act of 1947 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

109-461

U.S. Code:

Veterans Benefits, Health Care, and Information Technology Act of 2006, Pub. L. 109-461

Veterans Benefits, Health Care, and Information Technology Act of 2006 Short Answer Veterans Benefits, Health Care, and Information Technology Act of 2006 is relevant to government contractors because it can affect privacy, data-protecti…

Public Law:

114-23

U.S. Code:

USA FREEDOM Act of 2015, Pub. L. 114-23

USA FREEDOM Act of 2015 Short Answer USA FREEDOM Act of 2015 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

81-152

U.S. Code:

Federal Property and Administrative Services Act of 1949, 40 U.S.C. subtitle I and related provisions

Federal Property and Administrative Services Act of 1949 Short Answer Federal Property and Administrative Services Act of 1949 is relevant to government contractors because it can affect federal IT governance, acquisition management, rec…

Public Law:

113-283

U.S. Code:

Federal Information Security Modernization Act of 2014, 44 U.S.C. §§ 3551–3558

Federal Information Security Modernization Act of 2014 Short Answer Federal Information Security Modernization Act of 2014 (FISMA 2014) is relevant to government contractors because it governs federal information-system security and can…

Public Law:

100-235

U.S. Code:

Pub. L. 100-235; 101 Stat. 1724

Computer Security Act of 1987 Short Answer Computer Security Act of 1987 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

107-296

U.S. Code:

Homeland Security Information Sharing Act, 6 U.S.C. §§ 481–485

Homeland Security Information Sharing Act Short Answer Homeland Security Information Sharing Act is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive…

Public Law:

116-194

U.S. Code:

IT Modernization Centers of Excellence Program Act, Pub. L. 117-194

IT Modernization Centers of Excellence Program Act Short Answer IT Modernization Centers of Excellence Program Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and tr…

Public Law:

104-106

U.S. Code:

Information Technology Management Reform Act of 1996, Pub. L. 104-106, div. E

Information Technology Management Reform Act of 1996 Short Answer Information Technology Management Reform Act of 1996 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, an…

Public Law:

113-274

U.S. Code:

Cybersecurity Enhancement Act of 2014, 15 U.S.C. §§ 7421–7454

Cybersecurity Enhancement Act of 2014 Short Answer Cybersecurity Enhancement Act of 2014 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive informa…

Public Law:

89-487

U.S. Code:

Freedom of Information Act, 5 U.S.C. § 552

Freedom of Information Act Short Answer Freedom of Information Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

102-243

U.S. Code:

Telephone Consumer Protection Act of 1991, 47 U.S.C. § 227

Telephone Consumer Protection Act of 1991 Short Answer Telephone Consumer Protection Act of 1991 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

95-630

U.S. Code:

Right to Financial Privacy Act of 1978, 12 U.S.C. §§ 3401–3423

Right to Financial Privacy Act of 1978 Short Answer Right to Financial Privacy Act of 1978 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

103-322

U.S. Code:

Driver's Privacy Protection Act, 18 U.S.C. §§ 2721–2725

Driver's Privacy Protection Act of 1994 Short Answer Driver's Privacy Protection Act of 1994 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

104-13

U.S. Code:

Paperwork Reduction Act of 1995, 44 U.S.C. §§ 3501–3521

Paperwork Reduction Act of 1995 Short Answer Paperwork Reduction Act of 1995 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

106-102

U.S. Code:

Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809; 16 C.F.R. part 314

Gramm-Leach-Bliley Act Short Answer Gramm-Leach-Bliley Act is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

73-416

U.S. Code:

Communications Act of 1934, 47 U.S.C. §§ 151–646

Communications Act of 1934 Short Answer Communications Act of 1934 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

117-263

U.S. Code:

44 U.S.C. §§ 3607–3616; Pub. L. 117-263, div. E, title LIX, subtitle C, § 5921

In plain terms. This 2022 law wrote the government's cloud-security program, FedRAMP, into permanent federal law instead of leaving it as agency policy. FedRAMP is the standardized way agencies vet and approve cloud services that handle…

Public Law:

115-59

U.S. Code:

Social Security Number Fraud Prevention Act of 2017, Pub. L. 115-59

Social Security Number Fraud Prevention Act of 2017 Short Answer Social Security Number Fraud Prevention Act of 2017 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

107-56

U.S. Code:

USA PATRIOT Act of 2001, Pub. L. 107-56

USA PATRIOT Act of 2001 Short Answer USA PATRIOT Act of 2001 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

107-347

U.S. Code:

E-Government Act of 2002, Pub. L. 107-347

E-Government Act of 2002 Short Answer E-Government Act of 2002 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

114-185

U.S. Code:

FOIA Improvement Act of 2016, Pub. L. 114-185

FOIA Improvement Act of 2016 Short Answer FOIA Improvement Act of 2016 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

103-414

U.S. Code:

Communications Assistance for Law Enforcement Act, 47 U.S.C. §§ 1001–1010

Communications Assistance for Law Enforcement Act Short Answer Communications Assistance for Law Enforcement Act is relevant to government contractors because it can affect cybersecurity, incident-response, and contractor risk management.

Public Law:

107-296

U.S. Code:

Homeland Security Act of 2002, 6 U.S.C. §§ 101 et seq.

Homeland Security Act of 2002 Short Answer Homeland Security Act of 2002 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

116-207

U.S. Code:

Internet of Things Cybersecurity Improvement Act of 2020, 15 U.S.C. §§ 278g-3a to 278g-3e

Internet of Things Cybersecurity Improvement Act of 2020 Short Answer Internet of Things Cybersecurity Improvement Act of 2020 is relevant to government contractors because it can affect supply-chain security, prohibited-source screening…

Public Law:

117-58

U.S. Code:

6 U.S.C. §§ 681–681g

Cyber Response and Recovery Act Short Answer Cyber Response and Recovery Act is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

106-554

U.S. Code:

Information Quality Act, Pub. L. 106-554, § 515; 44 U.S.C. § 3516 note

Information Quality Act Short Answer Information Quality Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

105-304

U.S. Code:

Digital Millennium Copyright Act, Pub. L. 105-304; 17 U.S.C. § 512 and related provisions

Digital Millennium Copyright Act Short Answer Digital Millennium Copyright Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

113-291

U.S. Code:

Federal Information Technology Acquisition Reform Act, Pub. L. 113-291, title VIII, subtitle D

Federal Information Technology Acquisition Reform Act Short Answer Federal Information Technology Acquisition Reform Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records,…

Public Law:

115-182

U.S. Code:

VA MISSION Act of 2018, Pub. L. 115-182

VA MISSION Act of 2018 Short Answer VA MISSION Act of 2018 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

117-103

U.S. Code:

6 U.S.C. §§ 681–681g

Cyber Incident Reporting for Critical Infrastructure Act of 2022 Short Answer CIRCIA is the 2022 statute that directs CISA to create mandatory cyber-incident and ransom-payment reporting rules for covered critical-infrastructure entities.

Public Law:

117-263

U.S. Code:

Pub. L. 117-263, div. G, title LXXII; 40 U.S.C. note and related provisions

In plain terms. This law pushes federal agencies to adopt American artificial-intelligence technology responsibly, with safeguards for privacy and civil liberties. Who it applies to. Federal agencies adopting AI — led by the Department o…

Public Law:

114-153

U.S. Code:

Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836

Defend Trade Secrets Act of 2016 Short Answer Defend Trade Secrets Act of 2016 is relevant to government contractors because it can affect supply-chain security, prohibited-source screening, and technology-risk management.

Public Law:

107-296

U.S. Code:

Federal Information Security Management Act of 2002, Pub. L. 107-347, title III

Federal Information Security Management Act of 2002 Short Answer Federal Information Security Management Act of 2002 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and…

Public Law:

83-703

U.S. Code:

Atomic Energy Act of 1954, 42 U.S.C. §§ 2011–2297h-13

Atomic Energy Act Short Answer Atomic Energy Act is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling.

Public Law:

116-179

U.S. Code:

Pub. L. 116-179; 134 Stat. 857; amendments to 18 U.S.C. § 1030

Defending the Integrity of Voting Systems Act Short Answer Defending the Integrity of Voting Systems Act is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-s…

Public Law:

117-58

U.S. Code:

Infrastructure Investment and Jobs Act, Pub. L. 117-58; 135 Stat. 429

Infrastructure Investment and Jobs Act Short Answer Infrastructure Investment and Jobs Act is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive infor…

Public Law:

96-480

U.S. Code:

Stevenson-Wydler Technology Innovation Act of 1980, 15 U.S.C. §§ 3701–3723

Stevenson-Wydler Technology Innovation Act of 1980 Short Answer Stevenson-Wydler Technology Innovation Act of 1980 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and tr…

Public Law:

96-511

U.S. Code:

Paperwork Reduction Act of 1980, Pub. L. 96-511

Paperwork Reduction Act of 1980 Short Answer Paperwork Reduction Act of 1980 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

104-106

U.S. Code:

Pub. L. 104-106, div. E; 40 U.S.C. §§ 11101–11704

Clinger-Cohen Act of 1996 Short Answer Clinger-Cohen Act of 1996 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

108-447

U.S. Code:

Pub. L. 108-447; 118 Stat. 2809

Consolidated Appropriations Act of 2005 Short Answer Consolidated Appropriations Act of 2005 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

99-474

U.S. Code:

Computer Fraud and Abuse Act, 18 U.S.C. § 1030

Computer Fraud and Abuse Act of 1986 Short Answer Computer Fraud and Abuse Act of 1986 is relevant to government contractors because it can affect cybersecurity, incident-response, and contractor risk management.

Public Law:

104-231

U.S. Code:

Electronic Freedom of Information Act Amendments of 1996, Pub. L. 104-231

Electronic Freedom of Information Act of 1996 Short Answer Electronic Freedom of Information Act of 1996 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

96-157

U.S. Code:

Justice System Improvement Act of 1979, 34 U.S.C. § 10101 et seq.

Justice System Improvement Act of 1979 Short Answer Justice System Improvement Act of 1979 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

117-58

U.S. Code:

State and Local Government Cybersecurity Improvement Act, 6 U.S.C. §§ 665g–665i

State and Local Government Cybersecurity Improvement Act Short Answer State and Local Government Cybersecurity Improvement Act is relevant to government contractors because it can affect national-security, export-control, critical-infras…

Public Law:

104-104

U.S. Code:

Telecommunications Act of 1996, Pub. L. 104-104

Telecommunications Act of 1996 Short Answer Telecommunications Act of 1996 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

111-5

U.S. Code:

HITECH Act, Pub. L. 111-5, div. A, title XIII and div. B, title IV

Health Information Technology for Economic and Clinical Health Act of 2009 Short Answer Health Information Technology for Economic and Clinical Health Act of 2009 is relevant to government contractors because it can affect privacy, data-…

Public Law:

104-294

U.S. Code:

Economic Espionage Act of 1996, 18 U.S.C. §§ 1831–1839

Economic Espionage Act of 1996 Short Answer Economic Espionage Act of 1996 is relevant to government contractors because it can affect supply-chain security, prohibited-source screening, and technology-risk management.

Public Law:

104-113

U.S. Code:

National Technology Transfer and Advancement Act of 1995, Pub. L. 104-113

National Technology Transfer and Advancement Act of 1995 Short Answer National Technology Transfer and Advancement Act of 1995 is relevant to government contractors because it can affect federal IT governance, acquisition management, rec…

Public Law:

116-283

U.S. Code:

National Artificial Intelligence Initiative Act of 2020, 15 U.S.C. §§ 9401–9461

National Artificial Intelligence Initiative Act of 2020 Short Answer National Artificial Intelligence Initiative Act of 2020 is relevant to government contractors because it can affect AI governance, responsible federal technology adopti…

Public Law:

107-296

U.S. Code:

Cyber Security Enhancement Act of 2002, Pub. L. 107-296, title XXII, subtitle B

Cyber Security Enhancement Act of 2002 Short Answer Cyber Security Enhancement Act of 2002 is relevant to government contractors because it can affect cybersecurity, incident-response, and contractor risk management.

Public Law:

105-318

U.S. Code:

Identity Theft and Assumption Deterrence Act of 1998, Pub. L. 105-318; 18 U.S.C. § 1028

Identity Theft and Assumption Deterrence Act of 1998 Short Answer Identity Theft and Assumption Deterrence Act of 1998 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

99-508

U.S. Code:

Electronic Communications Privacy Act of 1986, 18 U.S.C. §§ 2510–2523, 2701–2713, 3121–3127

Electronic Communications Privacy Act of 1986 Short Answer Electronic Communications Privacy Act of 1986 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

107-204

U.S. Code:

Sarbanes-Oxley Act of 2002, Pub. L. 107-204

Sarbanes-Oxley Act of 2002 Short Answer Sarbanes-Oxley Act of 2002 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

116-50

U.S. Code:

Creating Advanced Streamlined Electronic Services for Constituents Act, Pub. L. 116-50

Creating Advanced Streamlined Electronic Services for Constituents Act Short Answer Creating Advanced Streamlined Electronic Services for Constituents Act is relevant to government contractors because it can affect privacy, data-protecti…

Public Law:

115-435

U.S. Code:

OPEN Government Data Act, 44 U.S.C. §§ 3502, 3506, 3507 and 3520A

OPEN Government Data Act Short Answer OPEN Government Data Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

104-191

U.S. Code:

HIPAA, Pub. L. 104-191; 42 U.S.C. § 1320d et seq.; 45 C.F.R. parts 160 and 164

Health Insurance Portability and Accountability Act of 1996 Short Answer Health Insurance Portability and Accountability Act of 1996 is relevant to government contractors because it can affect privacy, data-protection, and regulated-info…

Public Law:

113-101

U.S. Code:

Digital Accountability and Transparency Act of 2014, Pub. L. 113-101

Digital Accountability and Transparency Act of 2014 Short Answer Digital Accountability and Transparency Act of 2014 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and…

Public Law:

110-325

U.S. Code:

Pub. L. 110-325; 122 Stat. 3553; 42 U.S.C. § 12101 note and related ADA provisions

ADA Amendments Act of 2008 Short Answer ADA Amendments Act of 2008 is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

115-390

U.S. Code:

SECURE Technology Act, Pub. L. 115-390; 41 U.S.C. §§ 1321–1328

SECURE Technology Act Short Answer SECURE Technology Act is relevant to government contractors because it can affect supply-chain security, prohibited-source screening, and technology-risk management.

Public Law:

109-476

U.S. Code:

Telephone Records and Privacy Protection Act of 2006, 18 U.S.C. § 1039

Telephone Records and Privacy Protection Act of 2006 Short Answer Telephone Records and Privacy Protection Act of 2006 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

110-53

U.S. Code:

Pub. L. 110-53; 121 Stat. 266

Implementing Recommendations of the 9/11 Commission Act of 2007 Short Answer Implementing Recommendations of the 9/11 Commission Act of 2007 is relevant to government contractors because it can affect national-security, export-control, c…

Public Law:

115-435

U.S. Code:

44 U.S.C. §§ 3561–3583

Confidential Information Protection and Statistical Efficiency Act of 2018 Short Answer Confidential Information Protection and Statistical Efficiency Act of 2018 is relevant to government contractors because it can affect privacy, data-…

Public Law:

94-409

U.S. Code:

Government in the Sunshine Act, 5 U.S.C. § 552b

Government in the Sunshine Act Short Answer Government in the Sunshine Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

105-277

U.S. Code:

15 U.S.C. §§ 6501–6506; 16 C.F.R. part 312

Children's Online Privacy Protection Act of 1998 Short Answer Children's Online Privacy Protection Act of 1998 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

105-147

U.S. Code:

No Electronic Theft Act, Pub. L. 105-147

No Electronic Theft Act Short Answer No Electronic Theft Act is relevant to government contractors because it can affect federal IT governance, acquisition management, records, and transparency.

Public Law:

108-458

U.S. Code:

Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. 108-458

Intelligence Reform and Terrorism Prevention Act of 2004 Short Answer Intelligence Reform and Terrorism Prevention Act of 2004 is relevant to government contractors because it can affect national-security, export-control, critical-infras…

Public Law:

93-380

U.S. Code:

Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g; 34 C.F.R. part 99

Family Educational Rights and Privacy Act of 1974 Short Answer Family Educational Rights and Privacy Act of 1974 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

116-260

U.S. Code:

Pub. L. 116-260, div. U, title I; 40 U.S.C. § 11301 note

AI in Government Act of 2020 Short Answer AI in Government Act of 2020 is relevant to government contractors because it can affect AI governance, responsible federal technology adoption, and emerging-technology acquisition.

Public Law:

103-322

U.S. Code:

Pub. L. 103-322; amendments to 18 U.S.C. § 1030

Computer Abuse Amendments Act of 1994 Short Answer Computer Abuse Amendments Act of 1994 is relevant to government contractors because it can affect cybersecurity, incident-response, and contractor risk management.

Public Law:

37-67

U.S. Code:

31 U.S.C. §§ 3729–3733

In plain terms. The False Claims Act (FCA) is the government's main tool for punishing fraud against it. Its original caption read, "An Act to prevent and punish Frauds upon the Government of the United States." Who it applies to. Anyone…

Public Law:

91-508

U.S. Code:

Bank Secrecy Act, 31 U.S.C. §§ 5311–5336; 31 C.F.R. chapter X

Currency and Foreign Transactions Reporting Act of 1970 Short Answer Currency and Foreign Transactions Reporting Act of 1970 is relevant to government contractors because it can affect privacy, data-protection, and regulated-information…

Public Law:

91-508

U.S. Code:

Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x

Fair Credit Reporting Act Short Answer Fair Credit Reporting Act is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

63-311

U.S. Code:

Federal Trade Commission Act, 15 U.S.C. §§ 41–58

Federal Trade Commission Act Short Answer Federal Trade Commission Act is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling.

Public Law:

95-223

U.S. Code:

International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1708

International Emergency Economic Powers Act Short Answer International Emergency Economic Powers Act is relevant to government contractors because it can affect supply-chain security, prohibited-source screening, and technology-risk mana…

Public Law:

115-232

U.S. Code:

Export Control Reform Act of 2018, 50 U.S.C. §§ 4801–4852

Export Control Reform Act of 2018 Short Answer Export Control Reform Act of 2018 is relevant to government contractors because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information han…

Public Law:

81-774; 115-232

U.S. Code:

50 U.S.C. § 4565; 31 C.F.R. parts 800 and 802

Section 721 authorizes CFIUS review of covered foreign investment and certain real-estate transactions.

Public Law:

115-232

U.S. Code:

Pub. L. 115-232, § 889; 132 Stat. 1636; FAR 52.204-24, 52.204-25, and 52.204-26

Section 889 restricts federal procurement and use of certain covered telecommunications and video-surveillance equipment and services.

U.S. Code:

48 C.F.R. § 252.240-7997 (formerly 48 C.F.R. § 252.204-7020); 48 C.F.R. § 252.204-7019 deleted Feb. 1, 2026

Assessing Contractor Implementation of Cybersecurity Requirements Short Answer Effective February 1, 2026, DoD deleted DFARS 252.204-7019 and renumbered DFARS 252.204-7020 to DFARS 252.240-7997, narrowing it to cover only government-perf…

U.S. Code:

49 U.S.C. § 114(r); 49 C.F.R. parts 15 and 1520

SSI is a transportation-security confidentiality regime.

U.S. Code:

DFARS 252.204-7021 (48 C.F.R. § 252.204-7021)

CMMC Acquisition Rule Short Answer DFARS 252.204-7021 is the DoD contract clause that places CMMC requirements into solicitations, contracts, and covered subcontracts.

U.S. Code:

32 C.F.R. Part 2002

Controlled Unclassified Information (implementing rule) Short Answer 32 C.F.R.

U.S. Code:

Critical Infrastructure Information Act of 2002, 6 U.S.C. §§ 671–674; 6 C.F.R. part 29

The Critical Infrastructure Information Act protects qualifying voluntarily submitted critical-infrastructure information from public disclosure and certain regulatory uses.

U.S. Code:

32 C.F.R. Part 170

Cybersecurity Maturity Model Certification Program Short Answer 32 C.F.R.

U.S. Code:

Exec. Order No. 13556, 75 Fed. Reg. 68675 (Nov. 9, 2010)

Executive Order 13556 created the government-wide Controlled Unclassified Information (CUI) program.

U.S. Code:

Export Administration Regulations, 15 C.F.R. parts 730–774; International Traffic in Arms Regulations, 22 C.F.R. parts 120–130; Arms Export Control Act, 22 U.S.C. § 2751 et seq.

Export-controlled technical data can be a contract, national-security, and cybersecurity issue at the same time.

U.S. Code:

FAR 52.204-21 (48 C.F.R. § 52.204-21)

FAR Basic Safeguarding of Covered Contractor Information Systems Short Answer FAR 52.204-21 is the government-wide baseline safeguarding clause for Federal Contract Information.

U.S. Code:

26 U.S.C. § 6103

Internal Revenue Code § 6103 makes federal tax returns and return information confidential.

National Aeronautics and Space Administration Transition Authorization Act of 2017 Short Answer National Aeronautics and Space Administration Transition Authorization Act of 2017 is relevant to government contractors because it can affec…

U.S. Code:

32 C.F.R. part 117

The NISPOM Rule governs classified contractor security under the National Industrial Security Program.

U.S. Code:

NIST SP 800-171 Rev. 3; note current CMMC/DoD contract use of Rev. 2 where incorporated

NIST SP 800-171 is the main security standard federal agencies use to require contractors to protect Controlled Unclassified Information in nonfederal systems.

U.S. Code:

NIST SP 800-172 Rev. 3; note current CMMC use of selected NIST SP 800-172 Feb. 2021 requirements where incorporated

NIST SP 800-172 adds enhanced security requirements for higher-risk CUI environments, especially critical programs and high-value assets facing advanced threats.

U.S. Code:

Privacy Act of 1974, 5 U.S.C. § 552a

The Privacy Act governs federal agency systems of records and can flow into contractor operations when a contractor operates or supports a system of records for an agency.

U.S. Code:

Verify current Federal Register citation before implementation; maintain as proposed-rule page unless final rule has issued.

The proposed FAR CUI rule would create government-wide contract clauses for safeguarding Controlled Unclassified Information, but proposed text should not be treated as final until the FAR Council issues a final rule.

U.S. Code:

DFARS 252.204-7012 (48 C.F.R. § 252.204-7012)

Safeguarding Covered Defense Information and Cyber Incident Reporting Short Answer DFARS 252.204-7012 is the core DoD contract clause for safeguarding covered defense information and reporting cyber incidents.

Title 13 U.S. Code Census (Title 13) Short Answer Title 13 U.S. Code Census (Title 13) is relevant to government contractors because it can affect privacy, data-protection, and regulated-information handling. For most government contract…