The Information Technology Industry Council identifies concerns over the Pentagon's plans on cyber incident reporting from contractors in the context of the Cybersecurity Maturity Model Certification program, in response to a proposed rulemaking focused on acquisition requirements. A clause in the proposed rule would require a contractor to “Notify the Contracting Officer within 72 hours when there are any lapses in information security or changes in the status of CMMC certificate or CMMC self-assessment levels during performance of the contract,”...
