Call us now:
This is worth a read if you are focusing on the U.S DoD CMMC program. I do not remember writing the comment to the OUSD A&S, but it came to my email address, so maybe I did.
Comment: Does the DoD consider the international DIB to be in scope and how will they address CMMC compliance?
Â
Response: The DoD intends to engage with our international partners to establish agreements related to cybersecurity and ensure that foreign companies that support U.S. warfighters will be equipped to safeguard sensitive national security information. These agreements will establish a framework to address application of CMMC to non-US companies. Implementation of such agreements will be accomplished through the rulemaking process.
Here are a few thoughts.
1. It is positive that the DoD will be engaging with international companies to ensure that they are equipped to safeguard sensitive national security information, that one hopes means CUI. However DFARS 252.204-7012 came into force in 2017 and addressing the problem through rulemaking next year seems rather along time.
2. But one expects that it will address the challenges of oversight and assurance associated with assessing the international DIB. As there are not enough assessors to certify the U.S DIB let alone international partners.
3. It should also address the issue of cyber compliance and help the DIB comply with the 110 practices as it is clear most SMBs/ SMEs do not or cannot comply.
4. One also hopes that it will address the issue of risk acceptance and who will be allowed to accept cybersecurity risk compliance on behalf of the DoD.
Alternatively international organisation won’t have to comply; OR let the SEC cyber proposal drive compliance into U.S and EU primes and then through supply chain cyber into SMBs/SMEs.
Ted Dziekanowski
#cmmc #nistsp800171 #defenseindustrybase #defense #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7004147789618106368