Call us now:
The US United States Department of War CMMC program was always going to be a complex initiative to design and deploy. But no more complex than other global cyber regulations that include the SEC Final cyber rule, the Basel Accords for Capital Adequacy, EU NIS2, or DORA.
Cybersecurity risk management is the right thing to do. But CMMC was always going to be a difficult program to land. Problems started when the CMMC program didn’t reflect the objectives of US Federal Cyber regulations, and did not consider how the program was going to land with the DIB, where ‘rubber and road meet’. For example, there was little clarity on international DIB compliance, ITAR, or the complexity of compliance. This was been compounded by defence contractors’ compliance with DFARS cybersecurity requirements set out in 2017, as was pointed out by the GAO. There was little oversight by the Federal Government of DFARS 252.204-7012 that forms the foundation of CMMC Compliance.
The recent announcement by the DoW to pause CMMC Phase II was always going to come. Least of all because the US and International DIB never engaged in the original compliance program (2017), and the lack of enforcement, that sent a clear message to the DIB. Lessons learnt for cyber regulatory compliance globally were clear, there needs to be carrots and there need to be sticks.
Back in 2012, @Thaddeus Dziekanowski and I wrote the Augusta plan regime to enable DoD DFARS Compliance, while maintaining global compliance against Federal cyber regulations across a globally diverse DIB, protecting US DoD IP, pushing risk-based compliance and assurance to Prime contractors, incentivisation, and utilising available national and international resources to provide oversight, assurance, and attestation. The Augusta Plan was aligned with and took precedence from tried and tested international cybersecurity and compliance regimes. The Augusta Plan was presented to the DoD, Cyberspace Solarium Commission, and White House ONCD.
We have updated the Augusta plan to Version 4, in response to the recent suspension of CMMC Phase II. The Augusta Plan addresses the challenges of cybersecurity compliance across the DIB, and meets the objectives set out by the recent suspension of CMMC Phase II. The cost of cyber compliance will always be an issue for cost constrained contractors, but cybersecurity and national security are significant considerations irrespective and are the foundation of DFARS.
An Executive Summary is enclosed.
@Thaddeus Dziekanowski Bob Dix
@Parava Security Solutions
#dfars #cybersecurity #nationalsecurity
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7484547742258778112