DCMA | The Contracting Education Academy

December 8, 2020 By cs

What DoD’s cyber certification program reveals about info-sharing challenges

As the new regime takes effect, the tech industry’s lead trade association would rather higher level certifications be done by the department than independent third parties.

The Information Technology Industry Council is arguing that the foundation of U.S. cybersecurity policy — information sharing between organizations — presents a security threat that is too costly for many to address in response to a rule implementing the Pentagon’s Cybersecurity Maturity Model Certification Program.

The CMMC program was designed to change the Defense Department’s practice of having contractors simply attest to their own level of cybersecurity and institute a system of third-party auditors to validate required practices are in place.

The department’s Defense Contract Management Agency currently conducts audits of contractors’ cybersecurity through Defense Industrial Base Cybersecurity Assessment Center, or DIBCAC, assessments. But Katie Arrington, the DoD official heading up the CMMC program, said a new ecosystem of private third-party assessors is necessary to scale such reviews across all of the approximately 300,000 companies the department relies on.

Organizations hoping to work with the Defense Department would be required to obtain certification through an accreditation body that entered into a no-cost contract with the Defense Department on Nov. 25. The currently all-volunteer organization will be funded through fees it receives from assessors it trains to conduct audits and individuals it approves as qualified to consult with prospective contractors on CMMC requirements.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/12/what-dods-cyber-certification-program-reveals-about-info-sharing-challenges/170400/

December 4, 2020 By cs

Pentagon ready to name first 15 ‘pathfinder’ contracts for CMMC

It’s a significant week for the Defense Department’s Cybersecurity Maturity Model Certification program: New rules that serve as a precursor to the full CMMC implementation took effect on Tuesday, and an announcement of the first 15 contracts that will serve as “pathfinders” for the new model are imminent.

That initial set of procurements would represent the first real-world use of CMMC, the program the department has been building for the past year-and-a-half to shore up the cybersecurity of its industrial base. So far, DoD acquisition officials have only applied the model to contracts in non-punitive tabletop exercises, and without publicly identifying the contracts involved.

The department expects to name the first 15 pathfinders within “the next few days,” Katie Arrington, the chief information security officer in DoD’s acquisition and sustainment office told an industry conference. The announcement has been highly-anticipated as the defense industry waits to see how many vendors could be impacted by the initial pathfinder process.

Meanwhile, earlier this week, two precursors to the full CMMC rollout took effect — part of a sweeping rule change DoD promulgated in September to implement the program. Going forward, almost all vendors bidding on new contracts will have to log into a web portal and attest to which specific security controls in NIST Special Publication 800-171 they’re currently complying with.

Keep reading this article at: https://federalnewsnetwork.com/defense-main/2020/12/pentagon-ready-to-name-first-15-pathfinder-contracts-for-cmmc/

August 31, 2020 By cs

Government reliance on waiver argument to keep price adjustment windfall fails

The U.S. Court of Appeals for the Federal Circuit has articulated limits to the government’s ability to rely on the waiver doctrine to enforce Federal Acquisition Regulation (FAR) provisions of questionable legality.

In so doing, the court has cast doubt on the government’s “heads we win, tails you lose” approach to measuring the cost impact of simultaneous changes to a contractor’s cost accounting practices.

In The Boeing Company v. United States, 2019-2148 (Aug. 10, 2020), the Federal Circuit rejected the government’s argument that Boeing’s claim — which was based on an apparent conflict between: 1) a statutory provision limiting the costs the government may recover for cost accounting practice changes to the aggregate increased cost to the government, and 2) a FAR provision under which the government’s recovery considers only the changes that increase costs to the government, and disregards changes that decrease costs to the government — was waived because Boeing did not raise the issue prior to contract award.

Background

Contractors covered by the Cost Accounting Standards (CAS) sometimes change their cost accounting practices. They are allowed to do this so long as they disclose the changes and cooperate with the government’s efforts to determine whether, and the extent to which, the changes increase costs to the government. If changes in cost accounting practices do increase the amount charged to the government, the government is entitled to a price adjustment to neutralize the increased costs.

Keep reading this article at: https://governmentcontractsnavigator.com/2020/08/18/government-reliance-on-waiver-argument-to-keep-price-adjustment-windfall-fails/

May 14, 2020 By cs

Defense contractor certification body says maintenance of companies’ cybersecurity posture is within its role

The accreditation body overseeing the Defense Department’s cybersecurity certification for prospective contractors is also authorized to provide certified companies with cybersecurity services, according to members of the group’s board of directors.

“A continuous monitoring capability could provide benefits to organizations in the defense supply chain by increasing their awareness of changes to their current cybersecurity posture,” Mark Berman, chairman of the board’s communications committee told Nextgov. “This initiative is a potential avenue where we can provide value add to enhance and maintain the security posture.”

Berman was responding to comments from observers who say an April 22 request for proposal the accreditation board issued for a “continuous monitoring solution” marks a departure from the training and certification functions the group is expected to perform.

The Pentagon’s Cybersecurity Maturity Model Certification program is scheduled to take effect this fall following a change to defense federal acquisition regulations. Companies will have to attain third-party certification of their cybersecurity practices if they want to do business with the department. Defense contractors currently state whether they adhere to standards such as those outlined by the National Institute of Standards and Technology without any outside entity verifying their claims.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/05/defense-contractor-certification-body-says-maintenance-companies-cybersecurity-posture-within-its-role/165131/

May 13, 2020 By cs

DoD to deliver $3 billion in accelerated contractor payments over coming weeks

Just over a month ago, the Pentagon told its contracting officers and contract administrators to boost the amount of money it pays vendors in the form of progress payments as one way to increase their cash flow amidst a sagging economy. And the dollars have indeed started flowing.

As of last week, DoD had made $1.2 billion in additional progress payments because of the higher rates — which rose from 80% to 90% of the total contract value for large companies, and from 90% to 95% in the case of small firms. Ellen Lord, the undersecretary of Defense for acquisition and sustainment told reporters she expected the figure to rise to $3 billion in “the next week or two.”

For context, the department’s outlays for contracts are about $25 billion in total during an average month, making the $3 billion in accelerated payments a not-insubstantial sum. Lord said the added progress payments happened across 1,400 separate contracts, mostly because of a mass-modification the Defense Contract Management Agency processed to boost payment rates.

However, one open question — in the case of large contracts — is how quickly bigger firms are passing the advance payments down through their supply chains. Those figures, Lord said, are more difficult to track.

Keep reading this article at: https://federalnewsnetwork.com/dod-reporters-notebook-jared-serbu/2020/05/dod-to-deliver-3b-in-accelerated-contractor-payments-over-coming-weeks/

The Contracting Education Academy at Georgia Tech has established a webpage where all contract-related developments related to the coronavirus (COVID-19) are summarized. Find the page at: https://contractingacademy.gatech.edu/coronavirus-information-for-contracting-officers-and-contractors/

As the new regime takes effect, the tech industry’s lead trade association would rather higher level certifications be done by the department than independent third parties.

The U.S. Court of Appeals for the Federal Circuit has articulated limits to the government’s ability to rely on the waiver doctrine to enforce Federal Acquisition Regulation (FAR) provisions of questionable legality.

Background

The accreditation body overseeing the Defense Department’s cybersecurity certification for prospective contractors is also authorized to provide certified companies with cybersecurity services, according to members of the group’s board of directors.

Just over a month ago, the Pentagon told its contracting officers and contract administrators to boost the amount of money it pays vendors in the form of progress payments as one way to increase their cash flow amidst a sagging economy. And the dollars have indeed started flowing.

Search this Website