INFOSEC ALERT - NOTICE TO THE DEFENSE INDUSTRIAL BASE *UPDATED*

Scope

*UPDATED* SPECIAL NOTICE: CMMC PROGRAM Federal Organization Issuing Notice: U.S.

Army Corps of Engineers (USACE), Headquarters, Directorate of Contracting Description: USACE is awaiting issuance of the final DFARS Clause prior to fully implementing the Cybersecurity Maturity Model Certification (CMMC) Program, which establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

The CMMC Program also establishes requirements for contractors and subcontractors to conduct an assessment of compliance with the applicable cybersecurity standard for contractor information systems that: process, store, or transmit FCI or CUI; provide security protections for systems which process, store, or transmit CUI; or are not logically or physically isolated from systems which process, store, or transmit CUI.

The CMMC Program is designed to ensure defense contractors are properly safeguarding FCI and CUI that is processed, stored, or transmitted on defense contractor information systems.

FCI and CUI must be protected to meet evolving threats and safeguard nonpublic, unclassified information that supports and enables the warfighter.

The CMMC Program provides a consistent methodology to assess a defense contractor's implementation of required cybersecurity requirements.

The CMMC Program utilizes the security standards set forth in the 48 CFR 52.204-21; National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Basic Safeguarding of Covered Contractor Information Systems, Revision 2, February 2020 (includes updates as of January 28, 2021) (NIST SP 800-171 R2); and selected requirements from the NIST SP 800-172, Enhanced...