I dont think they will define ODP's in the FAR rule. What if they mandate 171 current version? Invalidating the class deviation? All kinds of questions. Great podcast!
@CarlyLogan-fh5fp
3 ай бұрын
This is a huge FAR reaching rule... (I see what you did there......) 🙂
@user-rr3ij5mz2o
3 ай бұрын
Agencies are already establishing their own approaches to protecting CUI. The HSFAR that DHS already has in effect (88 FR 40560, HSAR Case 2015-001, DHS Docket No. DHS-2017-0006) requires DHS Contractors to have an independent third-party assessment on the NIST 800-53 Moderate Risk Baseline, completely independent of CMMC, or the Department of Ed requirements for post-secondary institutions to apply NIST 800-171 to the financial information of students already create the specific issues you discuss with the different agencies having different approaches to implement 800-171. In that vein, I can't think of a Department whose interests would be more aligned with DoD that DHS, and DHS, to quote Fleetwood Mac, looked at CMMC and decided to "go your own way". The other thing here is that all CUI, while it may be defined by NARA, it may not have the same degree of risk across agencies. From that perspectice applying data governance principles, each agency may be allowed to make its own determination that it's ok with self-assessment, ok with an appropriate independent third-party assessment by CPAs or CISAs, or provide contracting units or Contracting Officers more leeway into including or waiving the agency-specific clause. bdr
@Summit7
3 ай бұрын
The HSAR final rule requires 3rd-party assessments for information systems being operated on behalf of the federal government, not for nonfederal information systems. The rule punts the decision about requirements and 3rd-party assessment of nonfederal information systems to the FAR CUI Rule. DHS has not decided to go their own way separate from CMMC despite their recent attempts at beefing up self-attestation for their contractors. Yes, the NARA CUI rule only requires the SP 800-171 baseline, it leaves the option of verification up to the various agencies.
Пікірлер: 4