Call us now:
U.S DoD DFARS, specifically DFARS 7021 (CMMC) is moving slowly ahead to a conclusion. A conclusion that is likely to see the 2020 IFR (DFARS 252.204-7019 and 7020), and CMMC (DFARS 7021) progress to OMB.
However, as the US Aerospace Industries Association state, DFARS 252.204-7012 is already here (Since 2017), and forms the basis for DFARS 7019, 7020 and 7021 compliance. It is highly likely that failing to comply with 7012 is a breach of contract for a covered entity and could be open to the False Claims Act (FCA), irrespective the geographic jurisdiction of the company.
One must remember that DFARS 252.204-7012 (https://lnkd.in/eP5MMmaj.) – SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING, requires the implementation of NIST SP 800-171 by a covered entity. The covered contractor must flow down the 7012 clause to covered subcontractors. Covered entities must report cyber incidents, and subject computing services to the security requirements specified in DFARS 252.239-7010.
This is not a simple or straight forward program, as the article points out and defense contractors should already be working towards compliance to the existing requirements.
One must also point out, that these requirement are in addition to those proposed by the SEC, that will affect public Defense Primes; EU cyber regulation such as EU NIS 2, or Local DPA regulations (e.g. GDPR).
Ted Dziekanowski Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberlaw #dfars #cmmc
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7053779688996917249