Call us now:
One has a controversial question:
It is very clear that the DoD needs to secure the DIB and that compliance to DFARS 252.204-7012 has not been met. But is CMMC needed, or has it been surpassed by recent cyber regulatory events? Events that provide Federal Government with the tools to enforce cyber compliance of the global defense industry to DFARS 7012, 7019 and 7020 with a focus on cyber risk and providing more flexibility than CMMC?
Last weeks final ruling by the SEC for cybersecurity risk management effects many global defense contractors, including foreign issuers. A ruling that requires covered companies to demonstrate they are managing cyber risk and supply chain cyber, reporting cyber incidents that are material to the organisation to the SEC. Compliance to DFARS 252.204-7012, 7019 and 7020 are existing contractual requirements to manage cyber, down the defense supply chain. Failing to comply to the DoDs cyber regulations under DFARS could result in the loss of a contract, that could create a material risk. Or the failure of a cyber audit could raise a material weakness, that would be reported to the SEC.
Furthermore CMMC compliance of the international DIB has not been communicated, as yet there is no mechanism for the DIB outside the U.S to certify to CMMC. But there are mechanisms in place for defense primes to attest to the SEC final ruling, that includes an assessment of supply chain cyber risk, through internal and external audit and board committees. Also the SEC fines regime is significant, leveraging the False Claims Act (Federal Contracts), that the DoJ is also focusing on. As a risk owner all the DoD need do is audit suppliers under existing regulations, that if material could result in a report the SEC. (Failure to comply with DFARS 7012 for example)
The DHS recently announced its plans to require CNI providers to secure CUI in alignment with FISMA and 32 CFR. FISMA is an act the DoD is required to comply, and has its own compliance program.
The ONCD recently asked for comment on the harmonisation of cybersecurity regulation across Federal Government. To align Federal cybersecurity regulations.
One argues that there are all the appropriate tools in place for the DoD to oversight and assure cybersecurity and the risk management of the defense industry globally. Oversight that can take place without the challenges associated with the ‘go, no go’ of CMMC. The DoD has to comply with FISMA, a cyber risk management program and the SEC controls access to the capital the defense industry relies upon, and has the regulatory fervour to protect shareholder interests. The SEC also demonstrates its own compliance to FISMA, which is not the case for the DoD.
One wonders if the proposed rule will make it to a final rule, as OMB looks at all the options.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA Bob Dix
#cybersecurity #cyberriskmanagement #cmmc #fisma
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7092104717182332928