Call us now:
Happy Christmas to the European Defense Defense Industry Base (DIB), as the U.S DoD will publish the proposed CMMC rule on the 26.12.23.
https://lnkd.in/esruYXJT
The DoD has not cut many bunches, CMMC will apply to international defense contractors (page 37), that are part of a covered supply chain, as stated in DFARS 252.204-7012. However, past issues relating to security clearance of assessors that are not from a national DIB, have not been addressed. Unless these are addressed there’s going to be problems ahead for the DoD and International DIB.
The DoD intends to include CMMC level 1 self assessment and level 2 self assessment for all applicable DoD solicitations and contracts as a condition for contract award. It may also require, at its discretion, a CMMC level 2 certification. Formal CMMC certification for all covered contracts will start 1 year after the introduction of DFARS 252.204.7021. The rule will require self attestation for FCI under FAR clause 52.204-21 for CMMC level 1. The Implementation and self Attestation of NIST SP 800-171 or certification assessment for CMMC level 2 demonstrating the security of CUI, depending on the contract. In both cases compliance data will be entered into SPRS for contract award.
The Proposal also assumes that the costs of compliance to the rule have already been met. As contractors that have already agreed to DFARS 252.204-7012, should already comply with NIST SP 800-171. This is definitely not the case.
Senior managers from Prime contractors and applicable subcontractors will be required to annually affirm continuing compliance with security requirements and after every assessment to affirm continuing compliance, including POA&Ms. Suppliers that self attest and input compliance score into SPRS could find themself having to justify their compliance scores to NIST SP 800-171 and NIST SP 800-172 controls. Opening the possibility of False Claims Act cases to be bought against DoD DIB Primes and suppliers.
www.cmmc-eu.com will be updated when the rule is finalized.
Ted Dziekanowski Brian D. McCarthy
#cybersecurity #cyberriskmanagement #CMMC #dfars
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7144283355923038208