Call us now:
The DoD DFARS/ CMMC program is important for U.S defense security. One often talks about it alongside the EU NIS, DORA, the CRA, Australia’s cybersecuirty laws and the Securities and Exchange Commission cyber proposal. Yet it’s been around since 2017 through DFARS 252.204-7012, and Federal Government has made no attempt to enforce it. The False Claims Act(FCA) is a piece of successful regulation that could be used in circumstances where contractors do not meet their contracted commitments to Federal Agencies. It has an impressive success rate applied to Federal Contractors (last weeks $280million award).
So why hasn’t it been applied in the case of DFAR 7012 compliance, as GAO reports have been clear that the security of CUI is a major problem for the DoD and national security. One suspects it hasn’t been applied for several reasons. That could be to do with national security, and supply chain security.
The enclosed article points to skepticism over the application of the DoD DFARS/ CMMC program. However the only material difference between the DFARS regulation that has existed since 2017 and 2019 is that DFARS 252.204.7021 is a requirement for a certificate of compliance. The need for compliance does no change, the application of NIST SP 800-171 does not change.
The elephant in the room for DFARS 252.204-7012 in ones opinion is not so much skepticism, it is that Federal Government has not moved to enforce compliance. Ever wonder why systemically important banks (SIB) are considered to be good at cyber, the answer is simple ‘regulation, regulatory capital and regulatory oversight’. SIBs are regulated to manage risk and regulators have the power to increase regulatory capital.
A further thought, what happens to the defense industry as regulation increases around them e.g. EU NIS 2, DORA, CRA, Australia cyber regulation? What happens to Prime defense contractors if the Securities and Exchange Commission moves ahead with cybersecurity risk management regulation for market entities? A regulator with a successful Whistleblower program. For example one wonders the next move for Rockwell Automation, as it was reported last week that the Defense department amongst orhers, are involved in oversight, following a whistleblowe complaint. It’s not FUD to say that there are concerns over national security.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #cyberreglation #cyberlaw
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7063438076005490688