supply chain security | The Contracting Education Academy

August 24, 2020 By cs

Number of foreign companies within Defense supply chain grew over past decade

Reliance on foreign suppliers in the defense industrial base rose — notably in packaged software and IT services — even as calls for reshoring increase, according to a new report.

Reshoring the defense supply chain may reduce national security risks, but a new report detailing a heavy dependency on goods and services from foreign countries like China shows reshoring may be easier said than done.

Researchers at Govini, a decision science company supporting the defense industry, analyzed data from over 1,000 Defense Department vendors across 100 industries to show how supply chain reliance on products from foreign countries has increased over the past decade. According to the survey, the number of Chinese suppliers in DOD’s base increased by a total of 420% since 2010.

For cyber and information technology, two statistics stick out. The share of companies based in foreign nations in the supply chain grew the most in the packaged software and IT services between 2010 and 2019. Companies based in foreign countries made up 3% of the packaged software supplier base in 2010. That number rose to 7% in 2019. The numbers are similar for IT services: Companies based in foreign countries made up 3% of the IT services supplier base in 2010 and 7% in 2019.

Keep reading this article at: https://www.defenseone.com/threats/2020/08/number-foreign-companies-within-defense-supply-chain-grew-over-past-decade-report-says/167767/

July 23, 2020 By cs

Cutting Chinese suppliers from government supply chains will cost billions every year

Prospective contractors are invited to comment on how much it might cost them.

**Click on image above to see Federal Register notice.**

Implementation of a rule barring federal agencies from entering into contracts with entities that use equipment from a selection of Chinese telecommunications and surveillance companies is expected to cost the government $11 billion in year one, and just over $2 billion each subsequent year, according to an action published in the Federal Register on July 14th.

The Federal Register action details an interim rule from the Department of Defense, the General Services Administration and NASA to implement the second part of section 889 of the John S. McCain National Defense Authorization Act of 2019.

Starting Aug. 13., Contracting Officers will include provisions in their solicitations that prohibit contractors from using the covered equipment and require bidders to state whether they do. Agency leaders can issue waivers in the case of emergencies, or other conditions, under the interim rule.

Covered equipment and services refer to those provided by Huawei, ZTE, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company or Dahua Technology Company, or any subsidiary or affiliate of those entities.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/07/cutting-chinese-suppliers-government-supply-chains-will-cost-billions-every-year/166846/

May 14, 2020 By cs

Defense contractor certification body says maintenance of companies’ cybersecurity posture is within its role

The accreditation body overseeing the Defense Department’s cybersecurity certification for prospective contractors is also authorized to provide certified companies with cybersecurity services, according to members of the group’s board of directors.

“A continuous monitoring capability could provide benefits to organizations in the defense supply chain by increasing their awareness of changes to their current cybersecurity posture,” Mark Berman, chairman of the board’s communications committee told Nextgov. “This initiative is a potential avenue where we can provide value add to enhance and maintain the security posture.”

Berman was responding to comments from observers who say an April 22 request for proposal the accreditation board issued for a “continuous monitoring solution” marks a departure from the training and certification functions the group is expected to perform.

The Pentagon’s Cybersecurity Maturity Model Certification program is scheduled to take effect this fall following a change to defense federal acquisition regulations. Companies will have to attain third-party certification of their cybersecurity practices if they want to do business with the department. Defense contractors currently state whether they adhere to standards such as those outlined by the National Institute of Standards and Technology without any outside entity verifying their claims.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/05/defense-contractor-certification-body-says-maintenance-companies-cybersecurity-posture-within-its-role/165131/

May 4, 2020 By cs

DoD sees CMMC as new way to monitor supply chain, spot shell companies

The Defense Department wants to implement its much-discussed Cybersecurity Maturity Model Certification program mainly to ensure every single one of its vendors is undertaking minimum levels of commonly-understood cybersecurity practices so it can protect its supply chain.

But Defense officials increasingly see CMMC as a way to monitor aspects of that supply chain that aren’t strictly about cybersecurity.

DoD expects tens of thousands of its contractors to earn a CMMC certification over the next five years. But to get one — even at the most rudimentary Level One of CMMC — each company will need an in-person visit from a third-party assessor. Those visits are primarily so that auditors can verify companies have actually implemented the security practices required for their level of certification, since no self-attestations will be allowed.

But there’s another reason DoD also wants a set of human eyes on each CMMC applicant: the department wants to make sure each firm that’s certified is actually a real company with real employees.

Keep reading this article at: https://federalnewsnetwork.com/defense-main/2020/04/dod-sees-cmmc-as-new-way-to-monitor-supply-chain-spot-shell-companies/

April 28, 2020 By cs

Pentagon’s cybersecurity certification plan includes continuously monitoring contractors

The accreditation body overseeing the Defense Department’s Cybersecurity Maturity Model Certification program — the CMMC-AB — issued a request for proposal that provides insight into how the group plans to keep track of contractors outside of conducting physical audits.

The CMMC will end the DoD’s practice of allowing contractors to “self-certify” their cybersecurity practices. Before the end of the year, the department intends to require companies doing business with the DoD to gain a certificate from third-party auditors that will be valid for up to three years.

“As part of the CMMC-AB’s efforts to mitigate risks posed to the country through sharing of sensitive information with DoD supply chain partners, a continuous monitoring solution will help fill in the gaps between assessments scheduled for once every three years,” the RFP reads. “The CMMC-AB is issuing this request for proposal to help us identify appropriate partners in our continuous monitoring solution.”

The CMMC-AB posted the RFP to its LinkedIn page with a May 1 deadline for responses.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/04/pentagons-cybersecurity-certification-plan-includes-continuously-monitoring-contractors/164821/

Reliance on foreign suppliers in the defense industrial base rose — notably in packaged software and IT services — even as calls for reshoring increase, according to a new report.

Prospective contractors are invited to comment on how much it might cost them.

The accreditation body overseeing the Defense Department’s cybersecurity certification for prospective contractors is also authorized to provide certified companies with cybersecurity services, according to members of the group’s board of directors.

The Defense Department wants to implement its much-discussed Cybersecurity Maturity Model Certification program mainly to ensure every single one of its vendors is undertaking minimum levels of commonly-understood cybersecurity practices so it can protect its supply chain.

The accreditation body overseeing the Defense Department’s Cybersecurity Maturity Model Certification program — the CMMC-AB — issued a request for proposal that provides insight into how the group plans to keep track of contractors outside of conducting physical audits.

Search this Website