Call us now:
The CMMC community has its latest bone to chew on, as one’s favourite open DFARS Case 2019-D041 inches forward to a conclusion.
While the proposal to complement DFARS 252.204-7012 (7012) with DFARS 252.204-7021(7021) moves forward for the DIB. 7012 and 7021 present many challenges for the US DoD, international governments, national security, and the US national and international DIB supply chain. Problems that have not been addressed in public comments by the DoD over the past four years, since my involvement in CMMC started.
The DOD has not yet holistically addressed the oversight or assurance of the National or International DIB compliance too DFARS 7012 or 7021. Whether a certificate of compliance is required or not, the DoD does not appear to have openly addressed two simple yet significant questions.
1. How does the DoD ensure compliance with DFARS 7012 for the entire DIB supply Chain? Self-attestation does not work; it is one reason CMMC was introduced.
2. How will the DoD provide oversight and assurance of the International DIB and their supply chains, either for 7012 or 2021 compliance?
With all will, as with the passing of 7012, and the general lack of DIB compliance. Without clarity, Mission will rightly take precedence over compliance. Therefore, compliance for the DIB must be a balance of ‘Carrot’ and ‘Stick’. One only has to look at the cyber regulatory approach by the EU under NIS 2 and DORA to understand that regulatory enforcement is the direction of travel.
There is no doubt that cybersecurity is a national security risk to the DoD. A risk that resides in its supply chains through IP theft and pre-positioning. Without cybersecurity, Mission may be compromised.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC United States Department of Defense
#cmmc
https://lnkd.in/eBpzFdx6
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7367490852232785920