Call us now:
Every US defense contractor should read this Settlement Agreement between US Supply Chain contractor Logzone and the US Navy. As DFARS compliance cost the contractor more than the value of their contract, when you include unallowable compliance costs ($500k fine ex costs vs. a $680k contract).
Logzone is a US logistical and inventory services company that provides services under contract for the Naval Oceanographic Command Property Management Program at Stennis Space Center, Mississippi. The contracts required Logzone to comply with DFARS 252.204-7012 and submit an SPRS score to the DoD.
Herein lies the problem: Logzone submitted a perfect NIST SP 800-171 score to SPRS, which was then followed by a DIBCAC assessment. NIST compliance scores can range from -203 to +110. The problem is that Logzone submitted a perfect score of +110, and from what we read, DIBCAC identified NIST compliance at -170, the lower end of the assessment range. Any auditor will tell you that perfection under cybersecurity assurance is not possible for most organisations. Submitting a perfect score put Logzone on the DIBCAC radar. Secondly, once on the DIBCAC radar, you open yourself to a very thorough evaluation of cybersecurity compliance under DFARS 7012. That’s what happened.
For the DIB, including the international DIB, compliance with DFARS 7012 has been required since 2016. As DFARS 7012 is a flow-down clause and contractual obligation, DFARS 7012 passes from Prime contractors to subcontractors following CUI. As we are aware, many contractors either did not understand they were covered by the clause or ignored compliance. Neither approach is acceptable under US Federal Law. The other issue is that historic compliance is also under the regulatory spotlight. SPRS compliance submissions have been required for several years.
With CMMC a regulation, the challenges faced by Logzone will become widespread. More organisations will realise they have compliance obligations they have either missed or submitted scores they will have to justify, as a certificate of compliance may be required from CMMC Level 2.
I will be discussing these issues and more as they relate to CMMC and DFARS compliance at the ADS Group Ltd Export Controls Workshop in July.
@Thaddeus Dziekanowski
@Parava Security Solutions
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7474388827671834624