Georgia Tech Procurement Assistance Center

DoD publishes long awaited interim rule on CMMC

By

At long last, the Department of Defense (“DoD”) has provided its interim rule, published in the Federal Register on September 29, 2020, amending the Defense Federal Acquisition Regulation Supplement (“DFARS”) to set forth requirements for the Cybersecurity Maturity Model Certification (“CMMC”) program, as well as new requirements for a “NIST SP 800-171 DoD Assessment Methodology.”  The interim rule is effective November 30, 2020, and comments to the interim rule should be submitted by November 30 as well. 

NIST SP 800-171 DoD Assessment Methodology

For contractors already required to comply with NIST SP 800-171, per DFARS 252.204-7012, DoD now is going to hold those contractors accountable, instituting an assessment and reporting system to verify compliance before new contracts can be awarded.  While the new requirement is for information to be provided prior to contract award, DoD encourages affected contractors to begin their self-assessments immediately.

The Assessment Methodology will include three assessment levels:  (1) Basic, (2) Medium, and (3) High.  The Basic Assessment will be a self-assessment completed by the contractor prior to contract award, while the Medium and High Assessments are available options for DoD to complete after award.  DoD estimates it will conduct 200 Medium Assessments and 110 High Assessments each year.  Additional information regarding DoD assessments is available here.

There is a specific scoring methodology to be followed for the Assessment.  A contractor that has fully implemented all 110 NIST SP 800-171 controls will have a score of “110.”  It goes without saying that contractors will need to be careful here – an inaccurate report could subject a company to exposure under the False Claims Act.

Assessments will be valid for three years unless there are issues requiring a reassessment sooner.  The newly-announced Assessment Methodology appears to be an immediate solution to provide DoD some peace of mind on contractor data security until the CMMC program can be fully implemented.

Continue reading at the Sheppard Mullin GovCon Blog.

Who pays for CMMC certification?

By

Last week, DOD announced the release of CMMC Version 1.0.  CMMC Version 1.0 is a comprehensive certification process featuring 171 cybersecurity best practices to ensure that contractors secure their information systems.  The question on everyone’s mind is who is going to pay for the certification and all of the work necessary to comply.

DOD has been less than clear on how contractors are expected to pay for CMMC certification. But what is clear is that the costs associated with obtaining CMMC certification will be significant.  It is unclear whether contractors can seek reimbursement for these costs.  They may be able to claim costs as an allowable indirect cost.  We suspect that the cost of certification itself will be covered, but that the greater costs associated with becoming compliant will not be covered as a reimbursable direct cost.

Continue reading at:  Fox Rothschild

The CMMC has arrived: DoD publishes version 1.0 of its new cybersecurity framework

By

On January 31, 2020, the Department of Defense (“DoD”) publicly released Version 1.0 of the Cybersecurity Maturity Model Certification (“CMMC”) framework.  The CMMC is a certification framework developed by DoD that measures a defense contractor’s ability to safeguard Federal Contract Information (“FCI”) and Controlled Unclassified Information (“CUI”) handled in the performance of DoD contracts.  By FY 2026, CMMC certification will be a requirement for any company doing business with DoD, either as a prime contractor or lower-tier subcontractor.  Version 1.0 of the CMMC fills in several gaps from the earlier drafts, which we assess in prior articles.  Additionally, the public briefing that accompanied the release of Version 1.0 included new insights into DoD’s rollout of the CMMC framework.  This alert walks through the CMMC framework, highlights updates from prior drafts, summarizes DoD’s proposed rollout, and provides considerations for companies during CMMC implementation.

Continue reading at:  K&L Gates

CMMC model 1.0 released: DoD’s unified cybersecurity standard for future acquisitions

By

In a major effort to strengthen the cybersecurity posture of the hundred of thousands of Defense Industrial Base (DIB) contractors and subcontractors, the Department of Defense yesterday released final Model Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC) framework.

This version replaces previously released versions 0.4, 0.6, and 0.7, which have been made available to the public via the CMMC official website.

Continue reading at:  JD Supra

Here are the NSA general counsel’s cybersecurity warnings

By

The U.S. government needs to do more to protect itself in cyberspace as adversaries’ technological capabilities rise, according to the departing general counsel of the NSA.

Glenn Gerstell, who is leaving the NSA later this year, said the expanding threat landscape — caused by the combination of nation-state’s capabilities and the onset of technologies such as 5G, artificial intelligence and the internet of things — presented several challenges that the intelligence community must grapple with long after he leaves the agency.

“It is almost impossible to overstate the gap between the rate at which the cybersecurity threat is getting worse relative to our ability to effectively address it,” Grestell said at an American Bar Association event Jan. 15.

Continue reading at:  Fifth Domain

Getting Ready for CMMC (Resources and Links)

By

The Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program will be a new contractual requirement for all DoD contractors.  It will impact the 300,000 firms that make up the defense industrial base.  It will not be a self-attestation model, but rather a third-party certification and compliance model.

In 2020, the DoD plans to finalize the CMMC framework and to start implementation with a select group of acquisitions.

Here are some go-to facts and resources to help you prepare.

You can find the resources and links at:  JD Supra

Recent cases indicate viability of False Claims Act liability connected to federal cybersecurity standards

By

Government contractors are no strangers to the numerous quality standards and assurances required by the government.  Over the past several years, cybersecurity in federal contracting has emerged as yet another standard to achieve.  While data breaches are big news in the private sector, the issue remained somewhat under the radar for public contracts — until now.

Last summer, two significant whistleblower cases sent ripples through the False Claims Act (FCA) community by demonstrating the specter of FCA liability resulting from the failure to comply with cybersecurity requirements in government contracts.  In May, the U.S. District Court for the Eastern District of California refused to dismiss a case alleging that Aerojet Rocketdyne Holdings Inc. falsely asserted its compliance with the Department of Defense’s (DOD) cybersecurity standards.  Then, in late July, the government announced that Cisco Systems Inc. agreed to pay $8.6 million to settle a whistleblower suit alleging that the company fell short of federal cybersecurity standards by selling video surveillance products with known vulnerabilities that hackers could exploit.  These cases show that cybersecurity-based FCA claims may be the new frontier and that such claims may prove difficult to defeat depending on the facts in any given case.

Continue reading at:  Carlton Fields

Why companies should start preparing for CMMC now

By

It’s a new year — and a new cybersecurity regime for vendors working on defense contracts is coming.

The Defense Department has been steadily working on its new unified standard, the Cybersecurity Maturity Model Certification (CMMC), and is expected to release a final version and a list of accrediting bodies in January.  But while companies shouldn’t wait until things are finalized to prep for certification, many are stuck.

“CMMC is going to be law of the land,” Corbin Evans, the director of regulatory policy for the National Defense Industrial Association, told Defense Systems, yet “folks are a little hesitant to make any major moves.”

Continue reading at:  Defense Systems

Podcast: 2020 will be a busy year for federal procurement

By

Fiscal year 2020, which coincides with calendar year 2020, started off busy on the federal contracting front.  Dan Snyder, the director of government contracts at Bloomberg Government, joined Federal Drive with Tom Temin for a look ahead.

Listen to the podcast at:  Federal News Network

How DoD’s new cybersecurity rules affect government contractors

By

At the end of the last year the Department of Defense (DoD) issued six guidance memoranda aimed at assisting acquisition personnel in developing what has been described as “effective cybersecurity strategies to enhance existing protection requirements.”  This included a mandate for the Defense Contract Management Agency to ensure that cybersecurity compliance will be a part of a contractor’s purchasing system audit and approval process.

Among the changes is the new Cybersecurity Maturity Model Certification (CMMC), which will replace the self-attestation model and move towards third party certification.  It will require all defense contractors and subcontractors to undergo a third party assessment of their internal cybersecurity technical practices and process maturity against published standards.

The final version of CMMC is set to be published by the end of January.  The certification will be built on existing requirements such as NIST SP 800-171, NIST SP 800-53, AIA NAS9933, private sector contributions, and input from academia.  An independent accrediting body will soon begin training the auditors.

Continue reading at:  Clearance Jobs

Contracting News

Read More

Contracting Tips

Read More

GTPAC News

Read More

Georgia Tech News

Read More