CMMC - What You Need to Know in 2022
Contact KLC Consulting: https://klcconsulting.net/contact/
What’s the latest in CMMC and DFARS compliance for US defense contractors? Find out here! Paul Casassa interviews DoD cybersecurity expert Kyle Lai:
• Practical advice from a cleared C3PAO candidate
• Authoritative resources
• COTS exemptions, DFARS requirements, and more
0:00 - Intro
0:21 – CMMC 2.0 changes overview
0:53 – 5 CMMC levels become 3
1:05 – Elimination of 20 practices above NIST 800-171
2:05 – POAM (plan of action and milestones) allowance
2:43 – Who needs CMMC level 1 / who needs CMMC level 2+
3:37 – When does CMMC become effective?
4:32 – What you need to do NOW!
5:08 – DFARS 252.204-7012 requirements explained
5:58 – DFARS 252.204-7020 requirements explained
6:53 – Latest CMMC update from DoD CIO townhall
8:28 – CUI Scope challenges addressed by CMMC 2.0 assessment guide
9:16 – Asset categories within CMMC assessment scope
11:16 – KLC’s CUI data lifecycle approach to scope CUI
13:00 – How to save money! CMMC and NIST 800-171 don’t need to be companywide!
14:12 – Bifurcation of CMMC level 2 explained
17:00 – How to handle compliance status inquiries from the DoD and prime customers
18:28 – What to do if you haven’t made your SPRS submittal (or lack confidence in yours)
20:00 – Prioritize NIST 800-171 POAM remediation following best practices to prevent a cyber attack
23:57 – Recommendations from NSA, DoD, The White House, FBI, and CIA t prevent cyber attacks
25:22 - Flow down requirements of DFARS 252.204-7012, -7020, and -7021 (CMMC) explained
28:04 – Flow down requirements exception for Commercial Off The Shelf COTS
28:50 – COTS exemption eliminates NIST 800-171 and CMMC requirements
31:45 – COTS qualification and how to obtain a COTS exemption
34:27 – DoD Incident Response Plan and Cyber Incident reporting requirements of DFARS 252.204-7012
36:10 – Either a CAC card or ECA certificate is required for DoD reporting. And here’s where to get one
36:44 – DoD requirements aside, here’s why every business needs a sound Incident Response Plan (IRP)
40:24 – Test your IRP effectiveness with periodic tabletop exercises
43:18 – CUI marking and labeling requirements, challenges, and solutions
48:36 – KLC is a C3PAO that provides flexible and affordable NIST 800-171 and CMMC compliance solutions
49:52 – Questions? Need help? How to contact us
Note: This video makes reference to Kyle's certifications including CMMC Provisional Assessor and Provisional Assessor. Certifications are imminent, pending final DoD notification.
www.klcconsulting.net