Call us now:
There has been a lot of debate as to whether the US DoD will formalize DFARS 252.204-7021 (DFARS 7021), known as the Cybersecurity Maturity Model Certification (CMMC).
Yesterday, it was announced by the DoD that the Federal Acquisition Rule changes necessary to formalise CMMC will be added to the US Federal Register on the 10th September. Effective 60 days following publication. Meaning CMMC will be formally available to defense program managers on a date agreed upon in the rule. Program managers appear to have the option to introduce CMMC in the first 3 years following the effective date. After which, DFARS 7021 becomes mandatory (Clause 4, page 5).
One must remember that although DFARS 7021 has been passed, DFARS 252.204-7012, 7019, and 7020 still apply. Requiring covered defence contractors to implement NIST SP 800-171.
https://lnkd.in/ejHNvvdD
One is pleased the DoD has clarified the requirements for the international DIB to comply with CMMC. Comment 16, page 27, highlights the requirements of the international DIB to comply with DFARS 7021 (CMMC). In short, the DoD is clear; as the DIB has been previously required to comply with DFARS 252.204-7012, it is therefore incumbent on the DIB to comply with the requirements of DFARS 7021 and obtain a certificate of CMMC compliance for DIB systems that handle CUI.
Now that the regulation has been passed, the international DIB must focus on compliance with DFARS 252.204-7012 and the implementation of NIST SP 800-171. A foundational requirement for passing a CMMC assessment at level 2 and level 3. Without which, a certificate of compliance cannot be issued and a contract awarded. Remembering that DFARS 7012 has a flow-down, following CUI, down the supply chain.
https://lnkd.in/eGy87H55
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC United States Department of War
#cybersecurity #cmmc
https://lnkd.in/ejHNvvdD
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7371460754346024960