Addressing Solicitation Contract Performance.

• Date: 01 June 2021
• Author: Ebner, Susan Warshaw,Sanchez, Rolando,Ebner, Susan Warshaw^Sanchez, Rolando
• Published date: 01 June 2021
• Author: Ebner, Susan Warshaw

Many of the questions surrounding the Defense Department's Cybersecurity Maturity Model Certification program have centered around how it will be rolled out and how contractors will be certified.

Similarly, questions surround the implementation of the Defense Federal Acquisition Regulation Supplemental Interim Rule on cybersecurity. That rule implements three clauses, DFARS 252.204-7019, 7020 and 7021, and centers on achieving compliance with required controlled unclassified information (CUI) security controls and protections for covered contractor systems pursuant to DFARS 252.204-7012 and NIST SP 800-171, as well as the implementation of CMMC and compliance with its additional requirements.

In the near term, contractors are scrambling to gain answers to what they need to do to comply and be certified at the proper level to remain competitive and more secure against adversaries. However, a practical question remains: what happens after compliance is achieved and a contract is awarded?

The above question was the theme of a recent tabletop exercise webinar hosted by the Cyber Legal Policy Committee of the National Defense Industrial Association's Cybersecurity Division. Key stakeholders from government and...