Brad Medairy

The Department of Defense (DoD) is proposing changes to the Defense Federal Acquisition Regulation Supplement (DFARS) to implement updates from the National Defense Authorization Acts (NDAAs) for FY 2018, 2021, and 2022. These changes aim to refine requirements for contractors to submit cost or pricing data. Key updates include: 1. Higher Threshold for Certified Cost or Pricing Data: The threshold is raised to $2 million, reducing paperwork for smaller contracts while maintaining certification requirements for larger ones. 2. New Requirements for Non-Certified Data: Contracting officers can request "data other than certified cost or pricing data" to verify price reasonableness, making organized and transparent pricing documentation essential. 3. Application to Commercial Products and Services: The rules now apply to commercial items, including off-the-shelf products and services, requiring the same data submissions as traditional contracts. 4. Stronger Focus on Fair Pricing: Contracting officers have increased authority to scrutinize pricing data, even when certified data isn’t mandatory, emphasizing the need for clear, well-documented pricing justifications. The public comment period for this proposed rule ends on November 25, 2024, with comments accepted at Regulations.gov.

2

lots of companies will need this in the future get ready

4

2 Comments

would like to see a little bit more stick, but its a start (still a slow process) Receiving AOs have the right to refuse participating in reciprocity with another organization due to insufficient content demonstrating an informed understanding of the security posture, risk assessment of the system, and the rationale for the risk determination as defined on the RMF KS, or due to excessive risk to the enclave or site, as determined by the site AO. However, the Receiving AO must document and report this refusal to the Granting organization’s AO within 10 business days. If a refusal does occur, both organizations will continue to work, and re-work, the ATO package to reach an agreement, if at all possible. When AOs cannot reach an agreement to leverage re-use and reciprocity, both parties must use the following resolution process to gain assistance in resolving the impasse: 1. If a conflict arises, due to reciprocity refusal there should be an attempt to resolve it at the AO level. This could include, but not limited to, the Granting AO conducting new assessments. 2. If the conflict cannot be resolved at the AO level, the RMF TAG Secretariat will be notified and the RMF TAG Chair will attempt to mediate the dispute as appropriate. 3. If the RMF TAG Chair cannot reach a resolution, the issue will be taken to the AO Council, chaired by the DoD CISO, who will serve as a mediator for the dispute. 

20

Enhanced Visibility & Hardening Guidance for Communications Infrastructure CISA has released actionable guidance to help organizations bolster the security and resilience of critical communications infrastructure. * Enhanced Network Visibility: Tools and strategies to monitor and detect potential vulnerabilities. * Hardening Measures: Practical steps to fortify systems against evolving threats. * Proactive Defense: Best practices for mitigating risks to critical infrastructure. Secure your communications systems today and stay ahead of potential threats. Explore the full guidance here: https://lnkd.in/gADKtUPf #Cybersecurity #InfrastructureSecurity #CISA #Resilience

30

Its budget season for many A&D companies. Keep this in mind as you plan for next year: ‘DOD releases final rule for CMMC, setting the stage for implementation next year’ https://lnkd.in/egXXCDaT

22

LMI leverages considerable experience across DoD in optimizing and updating internal controls and remediating audit findings to work with organizations. In keeping with the principles of LMI’s performance optimization line of business, our teams of subject matter experts optimize key controls for consistent, compliant, and effective operations. 👉 Have a question or concern related to your organization’s property tracking processes and related internal controls? Learn more about LMI’s steps for optimizing property tracking and connect with LMI subject matter experts today: https://hubs.ly/Q02Pdfhf0 // #PeoplePoweringPossible #Defense #Audit //

11

1 Comment

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

DoD to develop scalable genAI testing datasets Through a recently completed multi-pronged red teaming effort, the agency said it will develop repeatable testing datasets that can be used to evaluate large language model tools and services in the future. https://lnkd.in/ez-UHhFA

1

Interested in #AI or Autonomous Systems? Then check out this article by Axios on my company's CINO.

6

Cybersecurity Maturity Model Certification is an important protective measure for safeguarding critical information from adversaries. This is worth getting familiar with if you are collaborating with U.S. stakeholders.

9

🚨 The time for the federal government to move away from quantum-vulnerable cryptography has arrived. 6 U.S.C. Section 1526 requires OMB to report on key components of 🇺🇸’s strategy to migrate federal information systems to post-quantum cryptography (PWC). https://lnkd.in/e-bFxH9q

1

#CMMC community. Everyone has probably not yet noticed but the previous Glossary document has fallen off and was not updated to 2.13 version nor added to the CIO web page. Instead CMMC specific definitions are contained in 32CFR170. So they are still out there just not in a separate PDF. 32CFR170 we have found is a pain searching through to get to the definitions, and I think definitions are super important. So we have pulled together our own Glossary document and posted it. We reference where the definitions come from (we pulled some from 7012 as well) and then also added some of the NIST glossary definitions we use the most. Feel free to book mark and use as you see fit. Just a working aid. Cheers. Amira Armond Jacob Horne Carter Schoenberg Glenda R. Snodgrass, Linda Rust Ryan B. Kyle Lai Nathan Regola Kevin Wheeler

48

7 Comments

Interested in #AI or Autonomous Systems? Then check out this article by Axios on my company's CINO.

4

This would show great progress and open more doors! Forward thinking organizations are exploring the significant funding available for Cyber registered apprenticeships! Our Apprenticeships are tied to employment outcomes. #skillstorm Suzette Kent #skillsbasedhiring #cyber #cybersecurity #apprenticeships #cybersecurityapprenticeships #funding #skillsgap #Veterans #underrespresented #instructorledtraining #RTI #federal #employmentoutcomes #DOL #awscloud #awsdevops #javamicroservices #fullstackdevelopment #cybersocanalyst #penetrationtesting

2

1 Comment