Call us now:
The DoW CMMC program only added a layer of compliance assurance over cybersecurity compliance under DFARS 7012 and NIST 171, and all the recent announcements by the DoW on CMMC Phase II does is remove certification. It does nothing to change the need for compliance or the legal obligations associated with compliance.
The United States Department of War and U.S. Department of Justice have always had the tools under the False Claims Act to oversee, assure, and enforce compliance; they simply chose not to adopt them as vigorously as they could have. In part because the DoW and DoJ are between a rock and a hard place, requiring a functioning supply chain on one hand and protecting national security on the other.
But, like a sleeping giant, DFARS Compliance can awake at its choosing, and when it does, the False Claims Act is an effective tool at enforcing compliance. Why? Because DFARS compliance has been a requirement for over 10 years, and many companies were likely to be ambitious in self-assessing their compliance. As Logzone found out recently. One suspects the pool of potential DIBCAC assessments is quite large, and they can pick and choose when and where to assess compliance next.
The Next 60 days will be interesting as the DoD works out what and how to respond to DFARS 7012 and NIST 171 compliance. @Thaddeus Dziekanowski wrote the Augusta Plan back in 2021, refreshing it this week in response to the DoW RFI. Making the case 5 years ago for internal and external audit using IIA and AICPA assessors as part of a program to validate compliance, addressing both national and international NIST Compliance alongside risk-weighted BoMs and CUI-focused CSF profiles.
https://lnkd.in/e4jqWhfr
@Parava Security Solutions Breaking Defense
#dfars #cmmc #cybercompliance
https://lnkd.in/eaV5uDhd
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7485604570531012610