Call us now:
The old ones are the best, an important read for CMMC from the DoW. The DoW has published Guidance on the 15th January 2025 on applying the determination of the appropriate CMMC assessment by requiring activities. A requiring activity is an organization, command, or agency unit that identifies a need for supplies or services
The memo provides further clarity on the scenarios when CMMC shall be applied to contracts. Clarifying to Program Managers the CMMC phases and application of CMMC Levels 1, 2, and 3. It reaffirms when a requiring activity should inform program managers and procurement officers if a contract, task order, or delivery order involves covered defence information, including CUI or Operationally Critical Support. The required activity must notify whether CMMC self-assessment or certification is the minimum requirement. Note the term Operationally Critical Support (suppliers or services).
It includes the method for determining CMMC application and the process requiring activities follow to seek waivers for CMMC. Waivers will only impact whether CMMC assessments must be included in solicitation documents and resultant contracts. Waivers DO NOT AFFECT the security requirements under FAR or DFARS if applicable under DoW policy, AKA protecting FCI or CUI.
Note the clarification of the historical application of DFARS 7012 and 7019. One is not aware of any update to this memo.
@Thaddeus Dziekanowski Brian D. McCarthy Armando Seay
Veritas GRC United States Department of War
#cmmc #cybersecurity #cyberrisk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7419342366102171648