Call us now:
The US Department of Defence (DoD) is deploying a NIST (and DFARS) based standard through its Cybersecurity Maturity Model Certification (CMMC) programme. Their supply chain has over 300,000+ companies across its Defence Industry Base(DIB), extending globally. Whether you make boots or complex defence technology, you are likely to be impacted. CMMC mandates 5 levels of cyber maturity dependent on whether you hold and process FCI (Federal Contract Information) or CUI (Controlled Unclassified Information). Applying 48.CFR.52.204-21 and NIST 800 171-r2. To undertake contracts in the future companies will have to undergo a CMMC assessment, by a CMMC AB (Advisory Board) approved and qualified assessor.
It is likely to start deployment later in 2020, targeting new contracts and roll out over a 5+ year period. If you want to know more as a start go here https://lnkd.in/dbzYBpR
So I agree, NIST should be adopted by all businesses and the insurance industry for the assessment of cyber risks. I would recommend CMMC, when it is deployed, as an out of the box methodology. Created by an organisation which procures around $700bn annually.
I’m my experience on both sides of the debate, it should be applied to assess cyber risk maturity for policy underwriting, claims and much more.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6664067454060244992