The joint letter from the Association of American Universities (AAU) and the Council on Governmental Relations (COGR) addresses significant concerns regarding the interim Defense Federal Acquisition Regulation Supplement (DFARS) rule, Case 2013-D018, which expands safeguarding and reporting requirements for controlled defense information. The organizations, representing numerous leading U.S. research universities, express apprehension over the considerable compliance burden imposed by the new DFARS clause 252.204-7012, particularly the requirement to implement the comprehensive NIST SP 800-171 security controls. They argue that the estimated compliance hours in the rule are significantly underestimated, highlighting that actual institutional costs—including staff time, IT system upgrades, and ongoing maintenance—could reach millions of dollars for some universities. They further caution that these requirements might discourage participation in Department of Defense (DOD) research due to the high costs and administrative complexities involved, especially for not-for-profit and smaller institutions.
Additionally, the letter criticizes the lack of a clear exemption for DOD-funded fundamental research, fearing that the expanded definitions of "covered defense information" and "export controlled information" could inadvertently encompass basic research activities traditionally excluded from such regulations. The authors recommend that DOD reaffirm the fundamental research exemption and provide explicit guidance to prevent contracting officers from misapplying the new requirements. They also raise concerns about the application of cloud computing clauses, the overlapping and potentially redundant cyber incident reporting requirements, and the absence of federal funding to offset compliance costs. Ultimately, AAU and COGR urge the DOD and associated regulatory agencies to reconsider the scope and implementation timing of the interim DFARS rule, ensure flexibility in compliance, provide adequate cost adjustments, and maintain clear exclusions for fundamental research to preserve the productive research partnership between academia and defense agencies.
