Call us now:
The DoDs CMMC timeline is starting to firm up. The recent memo to DoD procurement officers has reaffirmed the need to assess SPRS submissions ahead of existing contracture obligations under DFARS 252.204-7012, 7019 and 7020 and the penalties for non-conformance.
Self attestation should raise a number of considerations for defence contractors of all shapes and sizes. One, does a contractor have DFARS 252.204-7012 in their contracts or not. DFARS 7012 should have been flowed down if a contractors creates, processes, stores or transmits CUI (2017). Two, if a contractor has submitted an SPRS score it should be an accurate and evidenced reflection of their cybersecurity posture (with SSP and POAM), three contractors should assess how the CMMC program will impact other regulatory programs leaving the Federal starting gates in 2022.
A big elephant in the room is the international DIB. There is no guidance on how the EMEA or APAC DIB will be assessed to be provided with a certification of CMMC compliance. Without which a procurement officer cannot award a contract. Four, cybersecurity standards are not yet regulated for the EU/ UK DIB to the same level, and applied standards are in general lower than those in U.S. The UK Cyber essentials requires 6 cybersecurity practices, NIST SP 800-171, 110 practices.
Reciprocity, oversight and assurance I am sure will be addressed between the EU, UK and U.S. Without global DIB cybersecurity practices across weapon system supply chains it will be difficult to sign off cybersecurity risks. An Authorization to Operate will require careful consideration, and in the short term mission will likely win. However that DoD has to manage cybersecurity risk through FISMA, and may look to manage the risk on shore.
Getting this right maybe cheaper than losing a contract?
Ted Dziekanowski
#cmmc #cybersecurity #defenceindustry
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6949643892694630400