.jpg?ext=.jpg)
Three Questions and Answers from the Smithers CMMC Webinar
On February 19th we presented a webinar titled, "CMMC Rollout: When Do I Need to Comply?" The webinar was presented in collaboration with GIE Media and Defense & Munitions Magazine. We were pleased to have a very engaged audience with a lot of great questions. If you missed the webinar live you can now watch the recording at your convenience.
We thought we would share three of the questions that came up during the webinar together with our answers. If you have questions, always feel free to contact us!
Question One: Do drawings with ITAR (International Traffic in Arms Regulations) or EAR (Export Administration Regulations) data fall into CMMC?
Answer One: Any item marked ITAR is automatically Controlled Unclassified Information (CUI) although all CUI is not ITAR. If you are not sure if your data falls under CUI (and therefore CMMC) you can check the National Archives CUI registry.
Question Two: Does being ITAR registered make us automatically have to be CMMC compliant? We don't have any contracts listing (DFARS 252.204) 7012 7019 7020 7021 7024.
Answer Two: Being ITAR registered does not immediately require CMMC compliance. If the organization has contracts that require the handling of ITAR data in order to meet the contract, regardless of the DFARS clauses 7012, etc, then CMMC compliance is required.
Question Three: When you say self attest in 2025 when 48 CFR comes out, is that meaning Self Attesting to CMMC L2 Compliance AKA 110/110 (110 NIST SP 800-171 controls)?
Answer Three: Contracts with CUI now have been required under DFARS 252.204-7012 to self-assess and self-attest to the NIST 800-171 status in SPRS since Jan 1, 2018. The contract should report what their actual score is, i.e. if self-assessment is 85, report 85. In order to receive a CMMC Final Certificate the organization must demonstrate a 110 of 110.
What Are Your Questions?
We hope you find these questions and answers helpful. Did this jog your memory about questions you have? Again, feel free to contact us. We are always happy to help companies in the Defense Industrial Base.