A coalition of industry groups is asking the Defense Department to make changes to its proposed acquisition rule for the Cybersecurity Maturity Model Certification program to address concerns over affirmation of compliance and how to track flow-down requirements in supply chains. “The term ‘affirmation’ has not been used in DOD contracts to date, but representations exist and are operational in federal contract administration and management by authoritative regulation. The rule introduces the requirement for an affirmation of continuous compliance with...
