Per the DoD, DIB contractors have some new obligations in order to renew or earn new contracts. If you’ve landed here, you are probably aware of this fact, but maybe you are wondering exactly what you need to do. Bound Planet is here to help; if you want this off your plate, feel free to reach out.
Otherwise, if you are looking to tackle this on your own, this might speed up the process.
- Research the ruling. Here is the rule at the Federal Register. This article published by Wiley also has great information.
- Understand how this applies. If your contracts include DFARS clause 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021, NIST 800-171, or CMMC ML 3 requirements, you are required to complete and submit a self-assessment by November 30th, 2020. Your contracting officer can likely help if you are unsure. If you solely produce commercial off the shelf goods (COTS), you are likely not required to do anything.
- Complete a self assessment. Check out the NIST SP 800-171 DoD Assessment Methodology for expectations and guidance on scoring, formatting, and how to submit your assessment. Annex A has a scoring template.
- Submit the assessment. Submit the assessment via an encrypted email to webptsmh@navy.mil. Be sure to review formatting requirements in the rule. In the rule, search for “NOTICE OF NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (NOV 2020)” or click here to go to the specific paragraphs.
Note – It is possible that you already have an assessment and score on file. If you have access to the SPRS (Supplier Performance Risk System), you may be able to check. Your current assessment must not be more than three years old.