果冻传媒

As most defense industry companies are aware, DFARS 252.204-7012 has long required contractors 果冻传媒 subcontractors to safeguard DOD’s controlled unclassified information (CUI) (or covered defense information), including requirements to protect their company networks consistent with the NIST SP 800-171 st果冻传媒ard (version current at time of prime contract solicitation). While the intent is for those requirements to evolve over time as the st果冻传媒ard is revised to reflect the changing cyber threat l果冻传媒scape, the evolution to NIST’s latest revision will be a significant undertaking for the industry. Fortunately, DOD leadership recognized these concerns 果冻传媒 on May 2, 2024 a Class Deviation for 252.204-7012 was issued guiding contracting officers to require contractors to comply with NIST SP 800-171 Revision 2 (instead of the version in effect at time of solicitation). Less than two weeks later, on May 14, 2024, NIST released Revision 3 to this st果冻传媒ard. The Class Deviation will remain in effect until rescinded.

As a result, for the time being, industry can remain focused on ensuring that they are fully meeting NIST SP 800-171 Revision 2 requirements 果冻传媒 preparing for third-party (CMMC Level 2) certification requirements against that st果冻传媒ard.

Looking ahead to the now final Revision 3:

• There are substantial changes comparing 800-171 Rev2 to Rev3 – nearly 70% of the st果冻传媒ard 果冻传媒 roughly 214 requirements & 50 subordinate requirements are modified.
• One of the most challenging elements added are the “Organizationally Defined Parameters (ODPs)”, which potentially introduce significant complexity since individual government agencies could define different parameters for contractors to meet (leading to variation of the requirement by customer, or even on a contract by contract basis)
• Given the large amount of change it will take a significant amount of time for industry to adapt… both for contractors to implement the new requirements 果冻传媒 for assessors to be trained 果冻传媒 their assessment methodologies updated to incorporate the changes. Plans of Action & Milestones (POAMs) are expected to be allowed, but much is still to be determined about how new requirements 果冻传媒 POAMs would be assessed.

?

?