91吃瓜网官网

The Department of Defense (DOD) has implemented requirements to ensure the protection of controlled unclassified information (CUI) within the supply chain. In addition to the reporting requirement, DOD set standards to protect CUI, as recommended by the National Institute of Standards and Technology (NIST) and expected the supplier community to do the same.

听

1.听 specifies these three required areas:

• Implement controls in NIST SP 800-171 revision 2
• Cloud service providers with CUI must be FedRAMP authorized
• Possess Medium Assurance Certificate to report to Department of Defense Cyber Crime Center (DC3)

2.听 specifies the maintenance of an assessment, no older than three years, with an entry in the Supplier Performance and Risk System (SPRS)

听

3.听 听is designed to enforce the protection of sensitive unclassified information shared and provides increased assurance that contractors and suppliers are meeting the cybersecurity requirements for nonfederal systems processing controlled unclassified information.

鈥淐overed defense information鈥� is CUI, as described in the ,听that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies鈥攁nd is either:

1.听 Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DOD in support of the performance of the contract, OR

2.听 Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

鈥淔ederal Contract Information鈥� as defined in section 4.1901 of the , is 鈥渋nformation, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, excluding information provided by the Government to the public (such as that on public websites) or simple transactional information, such as that necessary to process payments.鈥�

The full requirements can be found in the NIST publication: .

The 听is a shared data warehouse that provides storage and access to the NIST SP 800-171 assessment scoring information. This database contains the NIST SP 800-171 assessment date, score, scope, and plan-of-action completion date for every vendor location, identified by their Commercial and Government Entity (CAGE) code.

听

Vendors can view their own data and those with the 鈥淪PRS Cyber Vendor User鈥� role can manage their basic assessment scores.

At this time, it is unknown when NIST SP 800-171 revision 3 will be included as a requirement. Additional rulemaking will be required to modify the CMMC Program Rule. The current 听does not indicate when it will be rescinded (or have an end date).

CMMC requirements are not expected to be included in contracts until both the 32 CFR 搂170 and 48 CFR part 204 rules complete rulemaking. The completion of both rules will establish the effective date for the CMMC Phased Roll-out where CMMC requirements will be able to be included. Per the CMMC Program Rule, 鈥淚t should be noted the Department may include CMMC requirements on contracts awarded prior to 48 CFR part 204 CMMC Acquisition rule becoming effective, but doing so will require bilateral contract modification after negotiations.鈥�