The DoD has issued CMMC 2.0. Cybersecurity is a necessary requirement for the Defence Industry Base without a doubt.

← Back to Blog

The DoD has issued CMMC 2.0. Cybersecurity is a necessary requirement for the Defence Industry Base without a doubt. CMMC 2.0 will need some clarification.

CMMC Level 3 will be aligned with NIST SP 800-172 and Level 2 NIST SP 800-171.

Is CMMC 2.0 based upon DFARS 252.204-7012 and CUI. If so CUI it does not differentiate between small, media and large companies. A problem raised by the Senate Small Business Committee. Small businesses found it difficult to comply with CMMC 1.0 without funding. It’s early days, there needs to be clarity.

A significant challenge with CMMC 1.0 was the implementation, oversight and assurance of CMMC by international defence contractors. CMMC 2.0 requires CMMC at Level 3 to undergoe a Triannual government led assessment. This will require clarification as one challenge was the oversight and assurance of CMMC by international firms and access to defence contractors that deliver products and services to multiple jurisdictions. Also the reciprocity between jurisdictions that operate cyber security standards that are lower than those proposed by the DoD.

Ted Dziekanowski Jason Spezzano Brian McCarthy

#ransomware‚ #fisma‚ #ofac‚ #theaugustagroup‚ #theaugustaplan‚ #cybersecurity‚ #supplychainriskmanagement‚ #cyberriskmanagement‚ #compliance‚ #regulatorycompliance‚ #regulatoryoversight‚ #esg‚ #scrm‚ #cscrm‚ #fca‚ #cybercompliance‚ #cyberregulation‚ #cybergovernance‚ #falseclaimsact‚ #afcea‚ #afceacyber‚ #aws

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6862109805209808896