Call us now:
David Koran, thank you for posting your observations of CMMC Frequently Asked Questions and F-Q5. Covered entities must understand the basics of CMMC compliance, while keeping abreast with the continuous updates, feedback, and changes in CMMC compliance provided by the United States Department of War.
At risk of repeating myself (it’s a rhetorical statement). We’ve raised this time and time again about CMMC and how the international DIB is addressing CMMC compliance. CMMC compliance is rooted in DFARS 252.204-7012. For the past 10 years, the DIB has been required to address DFARS 7012 and comply with NIST SP 800-171. Over the same time frame, DFARS has expanded to include CMMC, broadening existing self-assessment requirements to include compliance certification. Now we are rapidly approaching CMMC Phase 2, one is very concerned that the international DIB supply chain is not prepared for assurance, and, as is already known, there are not enough assessors to assure compliance.
The enclosed FAQs simply demonstrate the complexity of CMMC compliance that the DIB across all tiers must address. With a backdrop of no defence cyber resources, existing non-compliance, and little or no first, second, or third line assurance Liz Sandwith CFIIA.
As was pointed out by my good friend John Weiler, CoFounder IT-AAC this week, we see C3PAOs going into administration at a time when the DIB needs assessors the most. That raises an obvious question: how many C3PAOs and CCAs exist in the UK and EU to certify the DIB?
A couple of observations. One is how much money is resting on CMMC compliance for Primes and their subcontractors. Two, who is carrying the supply chain risk of non-compliance?
@Thaddeus Dziekanowski Brian D. McCarthy
@Parava Security Solutions
#cmmc #c3pao #defenceindustrybase
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7458820543249539072