PARAVA – NEW WEBSITE – FISMA RMF DODi50090

On the 31^st of December 2020, the DoD released a necessary Instruction DoDI 5000.90 “Cybersecurity for Acquisition Decision Authorities and Program Managers,” establishing policy, prescribing procedures, and management of cybersecurity risk by program Decision Authorities (DA) and Program Managers (PM) in the DoD acquisition process.  For those organizations who contract with the DoD, this is a critical instruction. It sets out the foundations for cybersecurity risk-based decision-making within the Defence Acquisition System (DAS), utilizing the RMF, which includes an SCRM policy requirement for program managers.  It will significantly affect the relationship between DoD, DIB contractors, and subcontractors. The United States (US) government is aligning its thinking on Supply Chain Risk Management (SCRM).

In response, the Department of Defense (DoD) is actively working to develop and deploy cybersecurity and SCRM across the Defense Industry Base (DIB) through Defense Federal Acquisition Regulation (DFARS) and Department of Defense Instructions (DODI).  DFARS 252.204.7012 (DFARS 7012) and NIST SP 800.171 required compliance as of December 2017.  Making further progress, the DoD released its Interim Final Ruling in November 2020, adding DFARS .7019, .7020, and .7021, requiring contractors and subcontractors within the DIB to be compliant with 800.171 and the implementation of the Cybersecurity Maturity Model Certification (CMMC)..