Call us now:
The United States Department of War has suspended the second phase of the CMMC program, which involves CMMC Level 2 certification requirements being added to DoW contracts for contract award and completion.
But DoW cybersecurity is not down and out, as the DoW makes clear that it still expects contractors to comply with DFARS 252.204-7012 and NIST SP 800-171, and it will continue to enforce compliance, as it has done since its inception in 2016.
The issue at hand is the ability for the supply chain across the DIB to comply with CMMC Level 2, especially certification. Compliance is onerous, and there were not enough assessors, and certification was difficult to validate across the supply chain.
The DoW is between a rock and a hard place. On one hand, it clearly recognises the need for cybersecurity compliance and compliance with Federal and Defence Acquisition Standards; on the other, the DoW needs to find a method of compliance that is not complex and does not create a burden.
DFARS cyber compliance will not go away; the DoW has made that clear. The question now is how the DoW will enforce compliance. As @Thaddeus Dziekanowski and I wrote back in 2021, with the Augusta Plan, and presented it to the DoD, there’s a more economic and efficient method for DFARS 7012, 7019, and 7020 compliance. You don’t need certification if you enforce the regulations you already have at your disposal.
DoW cybersecurity won’t be going away; the question that remains is how the DoW will enforce compliance with DFARS 7012.
Brian D. McCarthy
#dfars
https://lnkd.in/eNf4AAfk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7482542929266417664