The Contracting Education Academy

Contracting Academy Logo
  • Home
  • Training & Education
  • Services
  • Contact Us
You are here: Home / Archives for federal regulations

March 25, 2021 By cs

CMMC: The dramatic year of the Pentagon’s contractor cybersecurity program

In 2020, an ambitious Defense Department effort to account for its suppliers’ cybersecurity had many in the community kicking and screaming in tow, but represents a new collective policy thrust that won’t be dismissed.  

The program, led by Katie Arrington, the chief information security officer for Defense acquisitions, is based on the idea that the government should incorporate security standards into its contract administration.

Arrington’s presentations on the program often include an estimate of how much is lost each year through cyber disruptions — $600 billion, according to research cited in the DOD’s answers to frequently asked questions about the program — and highlight intellectual property theft by China.

Before the idea of CMMC, companies within the defense industrial base simply pledged their adherence to cybersecurity practices outlined by the National Institute of Standards and Technology. A 2015 rule required Defense contractors to report cyber incidents and to provide “adequate security” using NIST Special Publication 800-171 to protect covered information. But it wasn’t until summer 2019 that the Defense Department started checking whether companies were implementing the standard.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2021/01/cmmc-dramatic-year-pentagons-contractor-cybersecurity-program/171084/

Filed Under: Government Contracting News Tagged With: CMMC, CMMC AB, CMMC accreditation, CMMC Accreditation Body, contractor information systems, cybersecurity, Cybersecurity Maturity Model Certification, DCMA, Defense Industrial Base Cybersecurity Assessment Center, DFARS, DIBCAC, DoD, FAR, federal regulations, industry feedback, manufacturing, NIST, SP 800-171

February 22, 2021 By cs

Why systemic bias exists in government contracting programs

President Joe Biden issued an executive order to advance racial equity and support underserved communities.

The executive order promotes racial equity and emphasizes that advancing that ideal requires a systemic approach to embedding fairness in the decision-making process; it encourages agencies to recognize inequities in their policies and programs and work to redress them.  Agencies are required to assess whether and to what extent their programs and policies perpetuate systemic barriers to opportunities and benefits for underserved communities.

The underlying emphasis here is that programs and initiatives that are meant to support, grow and allow the underserved communities to prosper are often hindered, and obstacles are created which prevent the full impact of the programs to be realized.

Too often, congressional initiatives to support underserved communities are implemented in regulations, programs, procedures and processes in such a way that all but neuter the intended outcomes. At best, under the mantra of ensuring that the benefits flow to the intended recipients, well-intentioned civil servants implement the programs in such a way to “protect” the underserved either from themselves or from would be charlatans, thus negating or totally eliminating the intended impact.  At worst, maligned bureaucrats can’t stand by and witness government programs generate wealth for minorities and the underserved communities, and thereby create procedural roadblocks, hurdles and sand traps.

There are countless examples of the above, but I will provide one for illustrative purposes. Consider the intended benefits of the Small Business Administration’s 8(a) Business Development Program.

Keep reading this article at: https://federalnewsnetwork.com/commentary/2021/02/why-systemic-bias-exists-in-government-contracting-programs/

Filed Under: Government Contracting News Tagged With: 8(a), bias, equity, federal contracting, federal regulations, racial equity, SBA, small business, systemic bias, underserved communities

February 15, 2021 By cs

CMMC model tweaks coming after industry feedback

The foundation of the Cybersecurity Maturity Model Certification (CMMC) — the Department of Defense’s new cyber requirements for contractors — will see some coming changes, its leaders recently said.

The DOD will make alterations to the highest level of the five-tier security model after receiving public comments on the recently issued CMMC Defense Federal Acquisition Regulation System rule.

The department issued an “interim final” rule in September instead of first issuing a proposed rule, which meant the rule took effect upon publication. But there was still a 60-day comment period for industry to weigh in. The Office of Management and Budget, which hosts the council overseeing acquisition rules, allowed for this because of “the threat to national security” embedded in supply chain vulnerabilities, Jessica Maxwell, a DoD spokeswoman said in a statement.

Keep reading this article at: https://www.fedscoop.com/cmmc-model-assessment-guide-to-get-tweaks-after-feedback-from-industry/

 

Filed Under: Government Contracting News Tagged With: CMMC, CMMC AB, CMMC accreditation, CMMC Accreditation Body, contractor information systems, cybersecurity, Cybersecurity Maturity Model Certification, DCMA, Defense Industrial Base Cybersecurity Assessment Center, DFARS, DIBCAC, DoD, FAR, federal regulations, industry feedback, manufacturing, NIST, SP 800-171

February 9, 2021 By cs

CMMC implementation creates issues for ‘shop floors’

As of Nov. 30, defense contractors and suppliers are required to comply with an interim rule that strengthens implementation of the Cybersecurity Maturity Model Certification (CMMC), which is designed to protect controlled unclassified information from hackers.

In December, the Legal and Policy Committee of the National Defense Industrial Association’s Cybersecurity Division hosted the second in a four-part series of tabletop exercises to dry run the implementation and highlight areas where special attention may be needed.  This exercise focused specifically on the implications for manufacturers in defense supply chains, probing deeper into issues from the first exercise, held in October.

Controlled unclassified information, or CUI, needs to be protected not only in enterprise information systems, but also in shop floor networks and systems where technical data may be at risk. The Defense Federal Acquisition Regulation Supplement 252.204-7012 clause that established CMMC mandates use of 110 security requirements defined by National Institute of Standards and Technology Special Publication 800-171 that are appropriate for information technology systems, but in many instances, not appropriate for operational technology systems as found in manufacturing facilities.

Manufacturing systems are capital investments expected to last 20 years or more.  Many run old operating systems that do not support patches or encryption.  Updates are expensive and rare.  Efficiency requires connectivity and safety requires easy, rapid access.  Workarounds are possible, but smaller manufacturers may need help in implementing them.

Keep reading this article at: https://www.nationaldefensemagazine.org/articles/2021/1/29/cmmc-implementation-creates-issues-for-shop-floors

Filed Under: Government Contracting News Tagged With: CMMC, CMMC AB, CMMC accreditation, CMMC Accreditation Body, contractor information systems, cybersecurity, Cybersecurity Maturity Model Certification, DCMA, Defense Industrial Base Cybersecurity Assessment Center, DFARS, DIBCAC, DoD, FAR, federal regulations, manufacturing, NIST, SP 800-171

February 2, 2021 By cs

DoD’s cybersecurity certification requirements to appear in DHS contracts

The Department of Defense is figuring out how to incorporate its Cybersecurity Maturity Model Certification (CMMC) program in contracts offered by the Department of Homeland Security, according to the official helming the initiative.

The CMMC program will ultimately require all defense contractors have their cybersecurity practices certified by a system of independent third party auditors. As it is now, companies simply pledge their adherence to security controls detailed in standards issued by the National Institute of Standards and Technology.

Rules to implement the program are expected to be finalized as early as next month and have caused some heartburn within the contracting community. But the program is being rolled out in phases — 15 prime contractors, and all their subcontractors, are being selected to undergo assessments this year — and won’t be fully applicable until 2025.

That led one participant during a virtual meeting hosted by the Armed Forces Communications & Electronics Association Thursday to suggest organizations might even want to deprioritize complying with the CMMC’s requirements.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2021/01/dods-cybersecurity-certification-requirements-appear-dhs-contracts/171551/

Filed Under: Government Contracting News Tagged With: CMMC, CMMC AB, CMMC accreditation, CMMC Accreditation Body, contractor information systems, cybersecurity, Cybersecurity Maturity Model Certification, DCMA, Defense Industrial Base Cybersecurity Assessment Center, DFARS, DIBCAC, DoD, FAR, federal regulations, NIST, SP 800-171

  • 1
  • 2
  • 3
  • …
  • 11
  • Next Page »

Popular Topics

abuse acquisition reform acquisition strategy acquisition training acquisition workforce Air Force Army AT&L bid protest budget budget cuts competition cybersecurity DAU DFARS DHS DoD DOJ FAR fraud GAO Georgia Tech GSA GSA Schedule GSA Schedules IG industrial base information technology innovation IT Justice Dept. Navy NDAA OFPP OMB OTA Pentagon procurement reform protest SBA sequestration small business spending technology VA
Contracting Academy Logo
75 Fifth Street, NW, Suite 300
Atlanta, GA 30308
info@ContractingAcademy.gatech.edu
Phone: 404-894-6109
Fax: 404-410-6885

RSS Twitter

Search this Website

Copyright © 2023 · Georgia Tech - Enterprise Innovation Institute