Call us now:
U.S DoD cyber requirements have been a contracted feature of DoD contracts since DFARS 252.204-7012 came into force in December 2017, requiring covered contracts down the down Supply chain to implement NIST SP 800-171. However since its inception 7 years ago, compliance to the DFARS standards across the covered DoD supply chain has been demonstrated by GAO audits to have been by-in large poor. The consequences of which have been reported to Congress several times.
The latest survey highlights the challenges the defense industry faces in complying to the existing DFARS rule, ahead of the planned implementation of CMMC (DFARS 252.204-7021) in 2025. Further identifying the knowledge gap of defense contractors in complying with the cybersecurity requirements, that could reside in a suppliers contract.
CMMC will come into force in 2025, introducing mandatory independent assessment of cybersecurity compliance across the supply chain of covered contractors. Certificates of compliance can only be granted by authorized assessors and without a certificate of compliance higher tier suppliers are not allowed to procure from covered contractors. This places contractors, and the DoD, in a difficult situation. As contractors are required to demonstrate compliance not NIST SP 800-171.
Contractors are also generally unaware of the False Claims Act (FCA). An Act dating back to the U.S Civil war and one that is used today. In short if a Federal Contractor takes Federal Money (defense contracts), and it misrepresents itself (it says it does what it does not like not meeting contractual obligations), then it could face a charge under the FCA. As several U.S Universities are currently finding out.
One suspect the next 12-24 months will be interesting as the DoD, Contractors and Congress wrestle with cybersecurity, CMMC and DFARS compliance. One thing is clear however cyber is being regulated across many sectors across the U.S and EU. The direction of travel has been set and national security and national cybersecurity are close to the top of regulatory challenges if recent Congressional Committee hearings are to be believed.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC United States Department of Defense
#cybersecurity #cyberriskmanagement #nationalsecurity #dfars #cmmc
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7247139083779473408