Call us now:
The CMMC is out of the starting blocks and moving forward and with all intents and purposes when it gets included in DFARS regulation, is going to have a significant impact on the Defence Industry Base (DIB) globally.
The current requirements for an assessor to assess CMMC compliance outside of the US look to be stringent. Only US citizens can become CA3 assessors, and you need to be a CA3 and above to assess cyber maturity from Level 3 (CUI). There are also potential requirements for the US government to establish bi-lateral agreements with other governments prior to issuance of authorisations related to the CMMC?(https://lnkd.in/dYsi5mH)
I’m looking for some advice and guidance from the security community? Looking at these requirements, what will the implications be for DIB contractors outside of the US? Will local laws and regulations permit this approach (good if they will), or will they hinder audits? For example a US citizen needing a country level security clearance to enter a European supplier. As they will be assessing IT networks, which may or may not be segregated and contain data belonging to another country.
Is one answer to have reciprocity between international partners who assess within country on behalf of the CMMC?
Thoughts anyone?
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6682226174405427200