CMMC-covered DoD defence contractors have had since 2017 to comply with DFARS 252.204-7012, self-attesting compliance.

← Back to Blog

CMMC-covered DoD defence contractors have had since 2017 to comply with DFARS 252.204-7012, self-attesting compliance. Submitting their NIST 800-171 compliance scores to the DoD Supplier Performance Risk System (SPRS), mandated by DFARS 252.204-7019.

We have seen several DFARS 252.204-7012 compliance cases successfully concluded by the DoD and DoJ. Raise for failing to protect CUI and apply NIS SP 800-171. An indication of the direction of travel as it applies to DFARS and NIST compliance.. One that is likely to be an easy win for the DoD and DoJ, given the levels of compliance and cybersecurity at the DIB globally.

Now CMMC is on the Federal Register and becomes law in November 2025. One wonders how employees will react as cyber oversight and assurance becomes an assurable activity. Where compliance cannot be ignored as part of self-attestation?

@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBA

Veritas GRC

#cybersecurity #cyberrisk

https://lnkd.in/eKWeBfs7

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7378005930678042626