How to Comply with the Department of Defense Interim Ruling: 800-171 Self-Assessment and Scoring
New ruling takes effect on November 30
The Department of Defense (DoD) recently issued an interim rule to amend the Defense Federal Acquisition Regulation Supplement (DFARS). The rule is designed to implement a DoD Assessment Methodology and Cybersecurity Maturity Model Certification (CMMC) framework to assess contractor implementation of cybersecurity requirements and enhance the protection of unclassified information within the DoD supply chain.
The rule states that as of November 30, 2020, upon contract award, all DoD contractors will need to have their official score entered into the Supplier Performance Risk System (SPRS). This score is based on the NIST SP 800-171 DoD Assessment Methodology and provides for the assessment of a contractor’s implementation of NIST SP 800-171 security requirements, as required by DFARS clause 252.204-7012.
There are three assessment levels—Basic, Medium, and High—that reflect the depth of the assessment performed and the associated level of confidence in the score resulting from the assessment. A Basic assessment is a self-assessment that the contractor completes. The federal government completes Medium or High assessments. The assessments are completed for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order.
If your organization has been instructed by the DoD to enter your score into the SPRS system and you need to first conduct a self-assessment to achieve a Basic assessment level, or if you want to be proactive, TalaTek has the assessment tools and knowledge to assist you in completing this process as soon as possible. Our skilled assessors can work with your organization’s security subject matter experts in completing a self-assessment and applying the DoD methodology to determine your score quickly and efficiently.
For more information about how TalaTek can provide this service, contact us at firstname.lastname@example.org for a demo and an estimate. We’d love to hear from you.