Are you informed of the DFARS cybersecurity compliance requirement? All DoD contractors (particularly small firms) must achieve basic cybersecurity criteria by December 31 2017 or potentially lose DoD contracts. Regrettably, many industrial enterprises are unaware of this or have no clue regarding what they need to do to comply. The first step to bid for a DoD contract is to consult a DFARS consultant and understand what all things are needed to be compliant.
In addition, a new cybersecurity standard, Cybersecurity Maturity Model Certification, was issued in 2020. (CMMC). Depending on the government contract, you may be required to comply with NIST 800 171 or CMMC.
NIST Special Publication 800-171
NIST Special Publication 800-171 addresses the security of “Controlled Unclassified Material” (CUI), defined as information developed by the government or on its behalf that is unclassified but requires protection.
NIST 800 171 is a series of standards outlining the methods and procedures businesses must undertake to protect this information.
Who Needs to Comply?
With cybersecurity, a top priority for the Department of Defense and all major companies, protecting industrial supply chains is more vital than ever.
Does your firm do business with the US federal government or DoD, either directly or indirectly, as a tiered supplier?
Due to heightened worries about intrusions, any manufacturer, whether OEM or tiered supplier, making a trade with the DoD, GSA, or NASA as of December 31, 2017, must comply with stated cybersecurity criteria.
Unfortunately, many industrial enterprises are unaware of this deadline or what they need to do to comply.
Companies actively working on a project for the DoD, irrespective of tier, must be familiar with the NIST compliance requirements outlined in the contract provisions.
If you are a manufacturer, you must ensure that you are in accordance with your federal government agreement.
NIST Requirements for Cybersecurity Compliance
The standards are defined in a National Institute of Standards and Technology document (NIST). The standards are divided into 14 categories, each with security criteria that must be met for DFARS compliance.
What are the Consequences of Noncompliance?
Suppose a contractor fails to provide proof of adherence, the organization risks being removed from the DoD’s approved vendor list. Any security standards not executed at the moment, particularly cybersecurity adherence, must now be reported to the DoD Chief Information Officer within 30 days of contract award.
Don’t put your company at risk. There are costs associated with being NIST compliant. However, they may not be as high as you believe.
Manufacturers must prepare for the NIST 800-171 rule, and you may be asking what steps you must take to fulfill federal government cybersecurity standards.
How to Obtain CMMC Compliance?
A new certification, Cybersecurity Maturity Model Certification, has been developed to improve the overall security posture of enterprises participating in government supply chains (CMMC).
To improve the security architecture of the Defense Industrial Base, the Department of Defense is migrating from NIST 800-171 to the CMMC framework (DIB).
You may need to undertake a CMMC evaluation by some outside party using the CMMC framework, or you may be able to conduct an assessment for CMMC compliance independently. It is determined by the amount of CMMC required and the piece of data handled during contract execution.
