Call us now:
As a founding member of the CMMC AB standards working group and having built and led both 1st and 2nd Lines of Defence for cybersecurity and risk across regulated markets, I know the CMMC intimately and in my opinion CMMC is the largest cybersecurity program with the potential to impact international defence trade. Being European my interest has been the international implementation of the CMMC standard and cybersecurity. The DoD is in a difficult place it needs to protect CUI and secure the DIB, but balance this with the economic consequences to Small Business and the National and International DIB.
CMMC Challenges, amongst others
1. The number of impacted defence contractors quoted will be wrong. In my experience DFARS 252.204-7012 has not flowed down the international supply chain, supported by DoD Inspector General and GAO reports. A Supply chain of contractors and subcontractors of all sizes and complexity. CMMC implementation will be broad and complex.
2. Has CMMC addressed international reciprocity of cybersecurity standards? The DIB is international with factories in countries that may not regulate cybersecurity nationally. Where subcontractors may not comply to DFARS 252.204-7012 and NIST SP 800-171 (hence CMMC). Implementation of CMMC will be costly and maybe uneconomic.
3. At present CMMC assessors will be needed in every country which supply the DIB (where appropriate DFARS clauses have been applied), requiring local security clearance. Or reciprocity of oversight and assurance will be required and at whose cost. Given the low level of cyber maturity and cyber skills in many countries reciprocity is unlikely to be at the right level. International CMMC assessment needs to be addressed. Alternatively Primes may have to carry the risk of compliance across their supply chain, or the DoD accept CUI is not secure.
4. FISMA is a significant Federal regulation which the DoD has to comply with. It requires the implementation of the RMF (NIST SP 800-37R2). I can only assume that the CMMC must align with the RMF?
Why will this impact international defence trade. CMMC will require a certificate of compliance from Primes and their subcontractors. No certificate no contract, no contract no trade (November 2020 IFR).
We created the Augusta plan (www.augustagrp.com) as an proposal to address the problems at hand. Not to replace CMMC, but to scale and ‘baseline’ oversight and assurance in the first instance, minimising the cost and impact (with Federal support) to the National, and International DIB.
Brian McCarthy Ted Dziekanowski Jason Spezzano
#theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #supplychainriskmanagement‚Â #cyberriskmanagement‚Â #compliance‚Â #cyberinsurance‚Â #insurance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esgrisk‚Â #cyberregulation‚Â #esgreporting‚Â #soc2‚Â #defenceindustry‚Â #esg‚Â #defence‚Â #dodi500090
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6841637812769443840