The question above has multiple answers you can choose from;
a. DFAS
b. FR-CI
c. DFARS
d. AR 25-2
The answer is (C) DFARS
On October 4, 2016, the Department of Defense issued a rule finalizing cyber reporting regulations. This rule was applicable to Department of Defense contractors and subcontractors. Notably, the final rule clarifies by CDI (covered defense information). This term is used in the DFARS (Defense Federal Acquisition Regulation Supplement). It defines CDI to include 4 categories; covered technical information (CTI); controlled unclassified information (CUI); operations security; export controlled information; and any other information identified or otherwise marked in the contract.
