Thank you for posting Chris Hughes . The House Armed Services Committee approved its version of the National Defense Authorization Act (NDAA) in…

← Back to Blog

Thank you for posting Chris Hughes 💭🔐.

The House Armed Services Committee approved its version of the National Defense Authorization Act (NDAA) in June for the Fiscal Year 2023.

Reading the 2023 NDAA, The House Armed Services Committee has highlighted concerns relating to the application of cybersecurity standard NIST SP 800-171 as required under DFARS 252.204-7012. On page 322 specific reference is made to the UK and its publication of an Industry Security Notification (ISN) in March 2021. Raising concerns of the implications to at least two critical DoD Programs and the wider implications if a similar position is adopted by other foreign partners on DoD programs.

The NDAA asks the DoD to evaluate the applicability of a class deviation for all relevant DoD programs and engage with partners to identify a permanent solution with foreign partners. Compliance with DFARS has been a problem since 2017 for the DIB and CMMC compliance starts in 2023. The DoD recently reaffirmed the need for DoD procurement officers to confirm DIB contractors have an NIST compliance submission in SPRS, and the penalties for non-compliance.

One wonders how equivalency can be reached when U.S, UK and EU cybersecurity standards differ so greatly. With 110 NIST SP 800-171 practices required for DFARS, and CMMC seeking a formal certificate of compliance in 2023. When there is no mechanism in place to assess foreign defence contractor compliance, other than assessing an SPRS submission.

If the amendment makes it past the various stages, The House Committee on Armed Services is looking for a report on the implications and impact no later than December 2022.

#dfars #NISTSP800-171 #cybersecurity #defenceindustry #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6953380208355811328