Six IT Talking Points: Briefing your CEO on DoD compliance

Feb 15, 2023 12:00 pm Cyber Security 144

As the head of IT, your job to keep your organization’s networks up and running and secure is a challenge in any environment—and even more so when you’re doing work for the Department of Defense (DoD). The aim of this blog is to help guide the critical conversations you need to have with your CEO and/or other top leaders in your organization to get the support you need to achieve compliance with DoD cybersecurity regulations.

Starting the Conversation

Your first goal is to educate your CEO on the very basics of DoD regulations—specifically, DFARS and CMMC—and the growing business and personal risks of noncompliance with these key standards. From there you’ll be well-positioned to make a strong pitch for the resources you need to do your job well. Our recommended top 6 talking points are: #1: DFARS 7012 is a contractual obligation

The work our organization does for DoD involves handling Controlled Unclassified Information (CUI) and so we have a DFARS 7012 clause in our contract(s). That means that we are contractually obligated to:

Implement NIST SP 800-171’s 110 security controls

Rapidly report cyber incidents to the Department of Defense Cyber Crimes Center (DC3) and assist with any follow-up investigations

Confirm that our Cloud Service Provider (CSP) has achieved the FedRAMP Baseline Moderate or Equivalent standard

If our CSP uses encryption for handling our CUI, we need to confirm that it’s using a FIPS 140-2 validated cryptographic module and has the FIPS certification to prove it

The DFARS 7012 clause also requires us to flow down all of these 7012 req ..

Support the originator by clicking the read the rest link below.