Now let’s throw in the vegetable on the plate that everyone is pushing around and avoiding, brussel sprouts, or as it is known, the United States…

← Back to Blog

Now let’s throw in the vegetable on the plate that everyone is pushing around and avoiding, brussel sprouts, or as it is known, the United States Department of War cybersecurity programs under DFARS, more specifically, CMMC.

The irony is that most defence contractors have ignored compliance with DFARS 252.204-7012 since its inception, requiring compliance with NIST SP 900-171 cybersecurity practices for the protection of CUI. CUI can be classed as ITAR.

From November 2025, CMMC, or DFARS 252.204-7021, is in effect. Starting in 2025, covered organisations must continue to self-assess compliance and submit their compliance scores to the DoW if they wish to be awarded a new contract or option. Moving into phase 2, late 2026, contractors that do not have a certificate of compliance won’t be awarded new contracts or awards.

The moral is that you may wish to skirt brussel sprouts around your plate, but do so at your peril. Both from an ITAR and CUI perspective. Non compliance to CMMC could mean no contract with the DoW.

Dak Hardwick

@Parava Security Solutions

#cmmc #dfars #cybersecurity #nistsp800171

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7440391388115943424