Call us now:
The CMMC has a few challenges in front of it that need resolving. The international DIB as yet is not considered in the figures, 80,000 is a gross understatement of the number of organisations that the DoD relies upon for its weapon systems. There are organisations outside of the U.S that manufacture weapon systems and create, process, store and transmit CUI. Organisation today where there is no mechanism in place to provide oversight or assurance of DFARS compliance.
Self attestation has always been a requirement since DFARS 252.204-7012 came into being in 2017. Self attestation that invariable meant that organisations didn’t actually comply with NIST SP 800-171 (see NDAA 2023 page 322) and the many GAO reports. That has still to been addressed by the DoD.
The CMMC program will be impossible to scale up to provide enough resources to oversight organisations due to national sovereignty issues of partner nations. Partner nation cyber standards are invariably poor (cyber essentials), or are not regulated. A reasonable solution is to use existing and highly qualified auditors such as those from the IIA or AICPA, that are already professionally qualified. Auditors that can operate internationally to oversight and assure compliance of the national and international DIB (it’s no different to SoX). Also wait for international cyber regulations to set cyber standards.
Finally the time its taken the DFARS and CMMC programs to evolve, international cyber regulations are coming into force through the EU NIS 2.0, DORA and SEC proposal. Setting cyber standards for CNI and public listed firms that will include Defense Primes. Regulations that require cyber security risk management over supply chains, That FISMA also requires and the DoD should have already implemented.
Ted Dziekanowski
#cmmc #cybersecurity #cyberriskmanagement #cyberregulation #defense #defenseindustry #dib #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7004534312180035584