Call us now:
This article from law firm Holland & Knight LLP is a useful read for my EU and UK defence colleagues, required to comply with the DoW CMMC program. It’s a rendition of CMMC affirmation, compliance, and what it means for ‘affirming officers’. The article reiterates what most have suspected: the importance of the word ‘affirmation’ in the CMMC compliance and the False Claims Act. Remembering that no affirmation means no contract, and false affirmation could lead to a False Claim.
An ‘Affirming Official’ must submit an annual affirmation of CMMC compliance to SPRS, attesting that an organisation has implemented and will maintain CMMC security requirements. ‘It’s no check box, it is a recurring certification submitted to the federal government as a condition of contract eligibility.’
When you certify compliance with DFARS 7012, that is a condition of payment, and that is false; it could trigger a false claim. There is debate among the legal community about the False Claims Act and the compliance bar. But for defence contractors, it’s hard not to be aware of CMMC, DFARS, and NIST 171. There is also a precedent set in the US, where the DoJ has built a stack of cases (2025). The article points out that those who affirm compliance without verifying its accuracy may be accused of acting with ‘reckless disregard’, and could establish a false claim. Finally, there are Whistleblower provisions of 10% and 30% of any recovery, incentivising employees to identify gaps between certification and reality..
Not only does CMMC and DFARS compliance create significant legal and compliance risk for covered UK and EU defence companies, but it also may create legal and compliance risk for their boards.
@Thaddeus Dziekanowski Brian D. McCarthy
@Parava Security Solutions United States Department of War
#cmmc #nationalsecurity #cybersecurity
https://lnkd.in/em_H_NFv
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7421998702426296320