Well worth a read if you are an EU supplier to Lockheed Martin.

← Back to Blog

Well worth a read if you are an EU supplier to Lockheed Martin.

Lockheed Martin has informed all active suppliers that they are required to submit their Cybersecurity Maturity Model Certification (CMMC) status through a new form to be completed in Exostar.

Based on a supplier’s history of contracts received and possible future work, suppliers are required to determine their required CMMC level and document the corresponding self-assessment or C3PAO assessment in the DoD SPRS.

There are several observations.
1. This is an attestation of compliance with CMMC by suppliers. It carries more ‘weight’ than simply saying I comply.
2. Based on the history of contracts received from Lockheed Martin, suppliers should determine their CMMC level. This requires suppliers to determine if and when they were required to comply with DFARS 252.204-7012, 7019, and 7020.
3. If a supplier were covered, they must determine whether they were required to protect CUI, and now FCI.

Lockheed Martin points out that previous Compliance Risk Assessments are available for review (cannot be edited) and any lapse in CMMC status will directly impact an organization’s ability to receive new contracts.

@Thaddeus Dziekanowski Brian D. McCarthy Daniel Akridge

Veritas GRC

#cybersecurity #cyberriskmanagement

https://lnkd.in/e96AN9GK

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7406627278954123264