The trade association for the industry’s largest companies recommends relying on vendor declarations.
If governments are going to insist on using certification schemes — like the Defense Department’s new Cybersecurity Maturity Model Certification program — in efforts to improve cybersecurity, they should at least consider technology vendors’ own assessments, the Information Technology Industry Council said in new policy principles.
“Governments should consider alternatives to certification, such as supplier’s declaration of conformity/vendor attestation,” reads the policy recommendation released two weeks ago.
The suggestion is among six items the group offered for governments’ consideration, amid the Defense Department’s high-profile rejection of “self-attestation” in developing its CMMC program.
ITI Senior Vice President for Policy and Senior Counsel John Miller said the guidance is meant for a global audience, and highlighted the traction certification schemes have had not just within the U.S. and the European Union but also in countries like Brazil and India.
“Cybersecurity certification is not a comprehensive, one-size-fits-all solution, nor should it be considered a solution of first resort,” the document reads. “Nonetheless, if governments choose to set regulations to mandate certification schemes even after recognizing the limitations of certification, we recommend they follow six key considerations.”
Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/09/big-tech-moves-against-certification-government-solution-cybersecurity/168230/
The Joint Artificial Intelligence Center (JAIC) may use a consortium of companies and academic institutions to procure technologies and services needed to make AI a ubiquitous force within the military. The model pays a consortium manager to oversee a group of companies that pay a small fee to be part of the club.
The IRS is using its relatively new, quickturn procurement vehicle — Pilot IRS — to support a governmentwide data collection effort in support of fixing pain points in the government’s acquisition process.
Industry has been waiting with bated breath for the audits as part of CMMC implementation, which is meant to protect defense industrial base networks and controlled unclassified information from cyberattacks. Contractors will be required to meet different levels of security — Level 1 being the lightest and Level 5 the most stringent — depending on the type of work they are performing. The new rules will require contractors to be certified by third-party auditors to ensure that companies are adhering to certain standards.
The Pentagon awarded its Joint Enterprise Defense Infrastructure cloud computing contract Friday to Microsoft.
