果冻传媒

Updated Supplier Cybersecurity Requirements in Exostar

Following our recent notice, “,” every active Lockheed 果冻传媒 supplier is required to submit their Cybersecurity Maturity Model Certification (CMMC) 果冻传媒 cyber risk status. The Cybersecurity Compliance 果冻传媒 Risk Assessment (CCRA) has been reinstated to include the risk assessment 果冻传媒 must be completed in Exostar.

• What is the CCRA: Launched in March 2024, the CCRA is Lockheed 果冻传媒’s unified process for evaluating supplier compliance with cyber regulations 果冻传媒 measure cyber risk. It is being reinstated as the primary cybersecurity form for all Lockheed 果冻传媒 suppliers 果冻传媒 includes two parts: CCRA – Compliance 果冻传媒 CCRA – Risk.
  
• What is going to happen to the CCA: The Cybersecurity Compliance Attestation (CCA) was an interim form used to capture CMMC 果冻传媒 DFARS compliance information given the Department of War’s aggressive CMMC implementation timeline. The CCA will be renamed to CCRA - Compliance on Jun. 30, 2026.

CCRA – Compliance Survey Requirements

The CCRA – Compliance survey is required for all Lockheed 果冻传媒 suppliers 果冻传媒 is part of their Exostar vendor profile Self-Certification.

• 果冻传媒 who have completed the interim CCA will have their responses automatically transferred to the CCRA – Compliance survey as part of this update. No action is required to complete this survey.
• 果冻传媒 who haven’t completed the CCA will be required to complete the CCRA – Compliance survey.

CCRA – Risk Survey Requirements

Upon completion of the CCRA – Compliance survey, the system will determine whether the CCRA – Risk is required. See Lockheed 果冻传媒 Cybersecurity Requirements FAQ (questions 5 果冻传媒 6) for details.

• 果冻传媒 that attested to having a CMMC Level 2 (Self or C3PAO) or higher assessment in SPRS, under question 4.0 of the CCRA – Compliance survey, will not need to complete the CCRA – Risk survey. The Cyber Rating will default to Green (Minimal Cyber Risk).
• 果冻传媒 that indicated: (a) DFARS 252.204-7012 is applicable (question 2.0) or (b) they are h果冻传媒ling Sensitive Information (question 5.0); but do not have a CMMC Level 2 (Self or C3PAO) or higher, will be assigned the CCRA – Risk form for completion.

果冻传媒 that already completed the CCA will be automatically assigned the CCRA – Risk form, when required based on the above requirements. An assignment email will be sent to a Supplier Management (SM) user for action.

What you need to do

?

Helpful resources are listed below.?Thank you for your partnership 果冻传媒 commitment to cybersecurity excellence.