Call us now:
Dear Medium-sized US defense contractor (less than 250 FTE, turning over EUR 50million).
CMMC is in the final stages of completion by the US government. You should have already implemented DFARS 252.204-7012; you should have flowed it down where you’ve identified CUI to your suppliers, who are likely smaller than you. You are unlikely to know what CUI is or where it is located, or the effects of the 110 171 controls.
Now we know that you haven’t done this. The DoD has done its research over the past 10 years and shown US DoD IP has been acquired by nation-states through the DIB.
You will have been sold all manner of solutions to solve DFARS Compliance. You will have been offered all manner of cybersecurity assessments. Yet the risk is still yours to carry; any program you run is at your expense. Solutions that only require a complete rebuild of your IT infrastructure, a complete organizational transformation, and a migration of your data to GCC high infrastructure with Microsoft in full or in part. There goes that shared responsibility model again @Thaddeus Dziekanowski.
DFARS 7012 was written as a control taxonomy before cloud infrastructure became prominent; it has not caught up. DFARS 7012 does not explicitly address the shared responsibility model; the 110 controls follow the CUI. It has not been robustly tested in court against a DoD weapon system contract, yet.
When one reads the 110 controls, they cover more than data. CMMC requires many people, processes, and IT solutions. There are no magic bullets, even banks that spend $100s million and get it wrong. You’re just a 50 FTE defense contractor.
That’s why we offer a better approach, based upon 100 years of cyber, risk, and governance experience.
Brian D. McCarthy Faisal Khan
Veritas GRC United States Department of Defense
#cmmc #cybersecurity
https://lnkd.in/eyrtYzs7
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7367859060362149888