Call us now:
A proposed DFARS 252.204-7021 or CMMC as its become known rule, has been published on the Federal Register. Meaning covered defense contractors globally must
1. Have a current CMMC certificate or self-assessment at the requisite CMMC level, or higher.
2. Maintain the required CMMC level for the duration of the contract for all applicable information systems.
3. Notify the contracting officer within 72 hours of any lapses in information security or changes in the status of CMMC certificate or self-assessment levels;
4. Complete and maintain on an annual basis, or when changes occur, an affirmation of continuous compliance with the security requirements;
5. Ensure all subcontractors and suppliers complete and maintain on an annual basis, or when changes occur, an affirmation of continuous compliance with the security requirements.
As Prime contractors are required to ‘flow down’ DFARS where CUI is processed, stored and transmitted. The Primes supply chain is affected globally by the rule.
A word of caution to covered companies outside the U.S, CMMC affects you to. Failure to comply could result in loss of contract. It could also put you under the False Claims Act, that has alot of precedence outside the U.S.
As a founding member of the CMMC, one looks forward to seeing how the UK and EU is addressing CMMC compliance. CMMC compliance creates strategic differentiation and competitive advantage.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC
#cmmc #defense
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7231220195799805952