• Implement NIST SP 800-171r2 security requirements on your information system and document control application for each of the 320 assessment objectives listed within NIST SP 800-171A
  

• Report any unauthorized disclosure of Defense Covered Information to DIBNet and ESA within 72 hours of discovery.

• Ensure that any cloud service providers processing, storing, or transmitting CUI are FedRAMP Moderate authorized or have an equivalent certification.

Quality

We are committed to providing safe, quality products and services. Our suppliers are expected to conduct their operations in a socially and environmentally responsible manner, aligning with 26D's values and ethics policy. 

• D0: Plan—Plan for solving the problem and determine the prerequisites.
• D2: Define and describe the problem—Specify the problem by identifying in quantifiable terms the who, what, where, when, why, how, and how many (5W2H) for the problem.
• D4: Determine, identify, and verify root causes and escape points—Identify all applicable causes that could explain why the problem occurred. Also identify why the problem was not noticed at the time it occurred. All causes shall be verified or proved, not determined by fuzzy brainstorming. One can use 5 Whys and cause and effect diagrams to map causes against the effect or problem identified.
• D6: Implement and validate corrective actions—Define and implement the best
corrective actions.
• D8: Congratulate your team—Recognize the collective efforts of the team. The team needs to be formally thanked by the organization.

• D1: Use a team—Establish a team of people with product/process knowledge.
• D3: Develop interim containment plan; implement and verify interim actions—Define and
implement containment actions to isolate the problem from any customer.
• D5: Choose and verify permanent corrections (PCs) for problem/nonconformity—Through preproduction programs, quantitatively confirm that the selected correction will resolve the problem for the customer
• D7: Take preventive measures—Modify the management systems, operation systems, practices, and procedures to prevent recurrence of this and all similar problems.