-
- News
- Books
Featured Books
- smt007 Magazine
Latest Issues
Current IssueCounterfeit Concerns
The distribution of counterfeit parts has become much more sophisticated in the past decade, and there's no reason to believe that trend is going to be stopping any time soon. What might crop up in the near future?
Solder Printing
In this issue, we turn a discerning eye to solder paste printing. As apertures shrink, and the requirement for multiple thicknesses of paste on the same board becomes more commonplace, consistently and accurately applying paste becomes ever more challenging.
A Culture of Thriving
One cannot simply command thriving; it must be nurtured, developed, and encouraged. In this issue, we explore strategies to improve your working relationship model—both internally and externally. In this culture of thriving, your business will grow in the process.
- Articles
- Columns
Search Console
- Links
- Media kit
||| MENU - smt007 Magazine
CMMC 2.0: Are You Ready?
July 6, 2022 | Nolan Johnson, I-Connect007Estimated reading time: 3 minutes
Nolan Johnson discusses with Ryan Bonner of DEFCERT exactly where and how EMS companies should aim for CMMC certification. Organizations, he says, “need to avoid false dichotomies where they assume that either CMMC is a go or it’s not happening at all. All the government mandated reviews to keep CMMC moving forward, resulting in new contract clauses, are already underway. The rule making is scheduled; it will happen.
Nolan Johnson: Ryan, what’s the status of CMMC 2.0?
Ryan Bonner: The aspects of CMMC 2.0 that those contractors can act on now, even while we wait on other components, are the model itself and the assessment guide. Those are the two documents that are most appropriate for contractors. Because those two items are in place, there is a path forward for CMMC, even while secondary aspects of CMMC, like the C3PAOs assessment process or the eventual contract clauses that will drive adoption, are under the surface, if you will, and are going through rule making.
Johnson: There is something tangible that we can proceed with in anticipation of everything else coming into place.
Bonner: Absolutely. Many organizations don’t realize that the shift to CMMC 2.0 was the outcome of a review by the Government Accountability Office. I believe it was congressionally mandated as well under the National Defense Authorization Act. That process has already been completed.
The big change coming out of that review process was to shrink the model back to only the requirements described in the original parent document, NIST 800-171. That creates a situation where now the CMMC model under 2.0 is identical to the requirements and assessment content that’s in both NIST 800-171 and NIST 800-171A (the document used to assess 800-171). Those are identical. They’re in lockstep. There’s no appreciable difference between the two.
Johnson: If my company has already completed NIST 800-171, what does this mean regarding CMMC?
Bonner: You should be aware of two ways you might be assessed or graded against what you’ve already done. If you have already worked on 800-171, or even completed your implementation, you have two pathways. The first is being assessed by the government or the defense contract management agency that’s done through their DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) teams. But the DIBCAC teams, at no cost to you, schedule either a moderate confidence or high confidence assessment and, because of that, assign you a completion score using their assessment methodology. That’s one way to be assessed against NIST 800-171.
The other pathway is a proactive approach where you seek CMMC certification. This involves the accreditation body and their authorized assessing organizations, which are the C3PAOs coming in and, at your cost, you are assessed and then certified. That certification is expected to be good for three years. The difference there is that contracting officers are allowed to request your CMMC certification as a source selection criterion for awards. That’s the big shift. Organizations that want to skip many of the government audited steps can go straight to private sector certification, and then have that on file to show you’ve completed everything in NIST 800-171.
They’re not mutually exclusive, so if organizations haven’t completed NIST 800-171 implementations, there is an additional change to rule making that we expect next March. It will involve setting either certain minimum threshold scores or specifying which of the 800-171 requirements must be done as a prerequisite for contract awards while other, perhaps less vital implementations, can be saved until a 180-day window after-contract award.
Johnson: Sounds like there’s room there to transition without being completely locked out.
Bonner: Correct. Organizations should be aware of how compressed a 180-day window is for completing your implementations. It’s not a lot of time based on how long it seems to take most contractors to implement.
Continue reading the rest of this interview in the July 2022 issue of SMT007 Magazine.
Suggested Items
I-Connect007 Editor’s Choice: Five Must-Reads for the Week
10/18/2024 | Nolan Johnson, SMT007 MagazineOccasionally, I’ll intentionally select items for this list that follow a theme. Sometimes, as they did this week, themes assert themselves. The component supply chain and sourcing seem to dominate our coverage this week. We’ve got an update from IPC Government Relations, an interview with counterfeiting watchdog ERAI, the 10 global sourcing rules, a course on AI and machine learning in the EMS sector, and warehouse management.
It’s Only Common Sense: Motivate Your Team by Giving Them What They Crave
10/14/2024 | Dan Beaulieu -- Column: It's Only Common SenseThe business world is teeming with challenges, and whether you’re in manufacturing, service, or technology, one universal truth holds steady: people are the backbone of any successful operation. If you’re not tapping into what your people crave, you’re missing a massive opportunity. It’s not just about salary or benefits anymore; it’s about something deeper, something that Gregg Lederman outlines perfectly in his book, "Crave: You Can Enhance Employee Motivation in 10 Minutes by Friday."
BMKyourproto, Luminovo Revolutionize Technical Customer Communication
09/25/2024 | BMKFor the past three years, the prototype service of Augsburg-based EMS company BMK and Munich-based software firm Luminovo have been working closely together to enhance communication between BMK and its customers.
It’s Only Common Sense: Selling PCBs Isn’t That Hard, Is It?
09/09/2024 | Dan Beaulieu -- Column: It's Only Common SenseSelling PCBs is a bit like playing chess; every move matters and the endgame is always about delivering value. If you've been in this business as long as me, you know that it’s not just about pushing product. It’s about understanding what the customer needs and how to meet those needs better than anyone else. Let’s be honest: Selling PCBs is no easy task. The market is competitive; the technology is complex, and the customers are demanding. But if you’ve got the right mindset and a few key strategies up your sleeve, success is within your reach.
It’s Only Common Sense: Hear That? It’s Opportunity Knocking
08/26/2024 | Dan Beaulieu -- Column: It's Only Common SenseI was reading the Sunday comics the other day when I came across a statement in “Hi and Lois” or maybe it was “Arlo and Janis” — one of those deep philosophical comic strips. One character says to the other, “He’s the kind of guy that when he hears opportunity knocking, he complains about the noise.” I love that. Not only because it’s funny, but because it’s also true.