Huntington Ingalls Industries, Inc. · NYSE:HII
Huntington Ingalls Industries — External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection (November 2024)
35 slides from Huntington Ingalls Industries's conference presentation, Nov 12, 2024
Slide 1: External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection
External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection Newport News Shipbuilding A Division of HII Greg Bandish, Jessica Borst, and Troy Vuyovich November 12-13, 2024
Slide 2: Housekeeping
Housekeeping We have all attendees joined on mute. As we go through the presentation, please submit questions via the chat box to the panelists and we will address them during pauses throughout the webinar. Thank you for attending!
Slide 3: Presentation Speakers
Presentation Speakers Jessica Borst Troy Vuyovich Greg Bandish Certified Information Security Manager (CISM) Sr. Regulatory Compliance Analyst Cybersecurity Supply Chain Risk Manager CMMC Program Manager Newport News Shipbuilding Huntington Ingalls Industries Oxford Global Resources
Slide 4: Agenda Topics
Agenda Topics • Supplier Support & Resources • Cybersecurity & BitSight • Federal Contract Information (FCI) • Controlled Unclassified Information (CUI) • CMMC Model 2.0 Requirements • Naval Nuclear Propulsion Information (NNPI)
Slide 5: Supplier Support & Resources
Supplier Support & Resources HII.com/Cyber
Slide 6: Supplier Support & Resources
Supplier Support & Resources Supplier Compliance Index Card Supplier Compliance Index Cards are used to view important supplier information and upcoming expiration dates. These Index cards are distributed monthly. Supplier Compliance Index Cards currently highlight Suppliers’ CUI and if applicable,
Slide 7: BitSight
BitSight A third-party service that helps HII assess and monitor the “external facing” cybersecurity posture of our Suppliers. Supply Chain Continuous Compliance Risk Competitive Management Monitoring and Reporting Mitigation Advantage • Identification of • As opposed to • Ensures • Identifies gaps
Slide 8: BitSight and Supplier Actions
BitSight and Supplier Actions If critically identified vulnerabilities are identified, Suppliers need to take action to remediate. Failure to respond or take action Supplier is directly notified of any findings, could result in an reviews BitSight account and takes action to If Supplier has a impact
Slide 9: Protecting Sensitive Information
Protecting Sensitive Information It is everyone’s responsibility to protect sensitive information. Three common forms of information distributed or received by NNS are: • Federal Contract Information (FCI) • Controlled Unclassified Information (CUI) • Unclassified Naval Nuclear Propulsion Informatio
Slide 10: FCI and CUI
FCI and CUI Information not intended for public Information the Government All CUI in possession of a release that is provided by or creates or possesses, or that government contractor or generated for the Government an entity creates or possesses subcontractor is FCI, but not all under a contract t
Slide 11: Requirements Matrix for Electronic Transmissions
The below matrix outlines requirements for sensitive information received by Suppliers from NNS. There are currently no requirements to receive sensitive information in hard copy format. Category or Document Electronic Transmissions Requirements Matrix for Sensitive Information Marking Examples comm
Slide 12: Transmission of FCI and CUI - Hardcopy
Transmission of FCI and CUI - Hardcopy The hardcopy transmission methods are the same for FCI and CUI. • May be sent to stand-alone fax machines • Faxed within the US and its territories provided there is an authorized person waiting to receive the document and properly control it; AND • Provided th
Slide 13: HII's Supply Chain Cybersecurity Compliance Risk Mitigation Program (SC3RMP)
HII’s Supply Chain Cybersecurity Compliance Risk Mitigation Program (SC3RMP) HII’s SC3RMP manages cybersecurity risk of our supply chain based on a three- pronged approach: Utilizes Exostar’s Onboarding Module (OBM) to collect Supplier’s input on cyber controls that manage HII and Government data Ga
Slide 14: Supplier Process for Evaluation to Receive Electronic CUI Transmissions
Supplier Process for Evaluation to Receive Electronic CUI Transmissions All suppliers are initially Supplier has a JCP onboarded as or requests to Hardcopy CUI Only receive CUI NNS Cybersecurity with or without JCP electronically reviews responses to Supplier Supplier NIST SP 800-171 provided info c
Slide 15: Electronic Transmission of FCI and CUI
Electronic Transmission of FCI and CUI The electronic transmission methods are the same for FCI and CUI. • Exostar Information Manager application • Email Encryption employing FIPS 140-2/140-3 encryption solution • Physically mailed to the recipient’s address • Fax machines, to include networked
Slide 16: FCI and CUI Controls
FCI and CUI Controls When In Disposal and Storage Use Destruction Concepts outlined below may not be all inclusive, depending on sensitivity nature of material. Control information posted or Physical protection controls Unless NNS authorizes retention by the processed on publicly accessible Su
Slide 17: Supplier-Originated CUI Documents
Supplier-Originated CUI Documents Supplier-originated documents that reproduce, expand upon, or modify information drawn from documents that now contain CUI must have the appropriate marking.
Slide 18: Pre-submittal Requirements for DLA Joint Certification Program (JCP)
Pre-submittal Requirements for Defense Logistics Agency (DLA) Joint Certification Program (JCP) Complete NIST SP 800-171 Active Commercial and Government Current System for Award assessment and load scores into Complete DD Form 2345 Entity (CAGE) Code Management (SAM) registration Supplier Performan
Slide 19: Questions
- Questions - Please add any questions in the chat box.
Slide 20: CMMC Model 2.0
CMMC Model 2.0 Reference: https://dodcio.defense.gov/CMMC/about
Slide 21: Cybersecurity Compliance
Cybersecurity Compliance DFARS 7012 Required Today Responsible for DFARS 7012 requires SPRS Score CMMC Re-Introduced contractors to comply with NIST SP 800-171 controls to Today, contractors must As Model 2.0 Evidence for protect Controlled submit their SPRS score, Unclassified Information based on
Slide 22: Anticipated Timeline
Anticipated Timeline 32 CFR CMMC Market Roll- 48 CFR CMMC Phase 1 (Establishes CMMC) Out (Implements CMMC) Begins Expected 48 CFR Expected Dec 16, 2024 Expected Dec 16, 2024 Expected Q2 2025 “Effective Date”
Slide 23: CMMC Phased Implementation
CMMC Phased Implementation Phase 1: Phase 2: Phase 3: Phase 4: Self-Assessments CMMC Level 2 CMMC Level 3 Full Roll-out to All Certifications Certifications 24 months after Phase 1 36 months after Phase 1 Begins at 48 CFR Rule start & requires DIBCAC start & all solicitations & 12 months after Phase
Slide 24: Changes and Impact to Suppliers
Changes and Impact to Suppliers Non-compliance risks losing new contract opportunities Covered contractor Covered contractor information systems with information systems with Ongoing Responsibility FCI CUI DFARS 252.204-7012 relied FAR 52.204-21 requires no on self-attestation for self-attestation M
Slide 25: Questions
- Questions - Please add any questions in the chat box.
Slide 26: U-NNPI
U-NNPI Unclassified information concerning the 48 CFR 52.204-21 32 CFR Part 2002 design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and What is OPNAV repair of the propulsion plants of naval N9210.3? nuclear-powered ships and prototypes, includi
Slide 27: OPNAVINST N9210.3
OPNAVINST N9210.3 • Guidance document for NNPI protections • Applicable to all equipment, components, systems, documents, drawings, information technology (IT) media, audiovisual media, and any other media or items containing classified or unclassified NNPI • Contains definitions, marking requiremen
Slide 28: Requirements Matrix for Electronic Transmissions
The below matrix outlines requirements for sensitive information received by Suppliers from NNS. There are currently no requirements to receive FCI and CUI in hard copy format, however, there are requirements to receive U-NNPI in hard copy format, as outlined below. Category or Document Sensitive In
Slide 29: Hardcopy Transmission of NNPI
Hardcopy Transmission of NNPI: • Faxed to a stand-alone fax machine • Faxed within the US and its territories provided there is an authorized person waiting to receive the document and properly control it; AND • Provided the receiving device is not connected to a computer) • NNPI may not be faxed ou
Slide 30: U-NNPI Authorized Computers and Electronic Transmission
U-NNPI Authorized Computers and Electronic Transmission • U-NNPI may not be processed or stored on a Supplier-owned computer system or portable electronic device unless authorized by NAVSEA 08 Cybersecurity. U-NNPI may only be transmitted via the Internet to NAVSEA-approved computer systems. • S/MIM
Slide 31: eProcurement Tools
eProcurement Tools • NNS has two eProcurement tools for NNS and Suppliers to communicate. • Both SPARS and Exostar’s Information Manager applications are not authorized for U-NNPI transmittals to, or from NNS. • NNS Supplier Compliance has been notified of reoccurring instances and has started suspe
Slide 32: U-NNPI Control
U-NNPI Control When In Disposal and Storage Use Destruction “Authorized individuals” are U.S. citizens or U.S. nationals with a Need to Know (NTK). Resident aliens (“green card” holders) are prohibited. NAVSEA 08 Security must be notified before granting access to Dual Citizens with NTK. Materials
Slide 33: Supplier-Originated U-NNPI Documents
Supplier-Originated U-NNPI Documents • Supplier-originated documents that reproduce, expand upon, or modify information drawn from U-NNPI documents must have the NOFORN marking at the top and bottom of every page. • The following warning statement must appear on a cover sheet or displayed on the fir
Slide 34: U-NNPI Disclosure Policy for NNS Suppliers
U-NNPI Disclosure Policy for NNS Suppliers • Supplier shall report to their NNS Buyer any attempts by unauthorized persons to elicit U-NNPI and any known or suspected compromises of U-NNPI • Includes intentional or unintentional public release via such methods as: • Known or suspected compromise of
Slide 35: Questions - Thank you for attending
- Questions - Please add any questions in the chat box. Thank you for attending today’s webinar. A PDF copy of the webinar will be posted to the NNS Supplier website before the end of the week.