Call us now:
In my view the DoD is laying the ground work for the CMMC program. Reaffirming DFARS clause 252.204-7012, the implementation of NIST SP 800-171 at a minimum, and the penalties for non compliance. Penalties that Include withholding progress payments; foregoing remaining contract options; and potentially terminating the contract in part or in whole, if a contractor has not input their compliance score to SPRS. That one assumes could be applied by a contractors to a subcontractor through flow down. It also reminds contracting officers to inform DIBCAC if they believe that a High or Medium level NIST SP 800-171 assessment is required under DFARS 252.204-7020.
For contractors that rely on cloud service providers, they are required to be FEDRamp moderate or equivalent. Under the shared responsibility model they should ensure not only that their cloud vendors controls are compliant to FEDRamp, and their application vendors controls and their own controls are also compliant and assessed. Before a NIST SP 800-171 submission is made to SPRS. Ted Dziekanowski, thoughts?
The DoD DFARS program for cybersecurity compliance is slowly moving forward. I wonder if and how these penalties will be levied.
#cybersecurity #dfars #dfars2522047012 #cmmc #falseclaimsact #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6947073436573691904