It’s important to frame the recent updates by the U.S DoD and Federal Acquisition Regulations.

← Back to Blog

It’s important to frame the recent updates by the U.S DoD and Federal Acquisition Regulations. While the CMMC related DFARS regulations were recently passed. CMMC is simply an extension of DoD cyber compliance regulations that started back in 2017 under DFARS 252.204-7012, added to in 2019 and now the fourth DFARS rule, DFARS 252.204-7021.It has to be noted that DFARS 252.204-7012 has always required covered organisations self assess compliance to 110 cybersecurity requirements of NIST SP 800-171.However, the CMMC DFARS regulation brings into force requirements for covered defense contractors across the covered CUI supply chain to undertake an independent assessment of compliance, and submit an assessment certificate before it can deliver against a covered contract.For those contractors that continue to submit their compliance through self assessment, one does have to be careful of the False Claims Act. If the DoD choses to it can enforce compliance to the DFARS 252.204-7012 at any time and hold covered DIB contractors, accountable to demonstrating compliance. That begs the question why has the DoD not done this? One wonders what the new U.S Defense Secretary strategy for FISMA and DIB cybersecurity will be?@Thaddeus Dziekanowski Brian D. McCarthyVeritas GRC United States Department of Defense#cybersecurity #cyberriskmanagement #cmmc

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7270378869591785473