Stacy Bostjanick at NDIA on CMMC

Stacy S. Bostjanick - OUSD A&S Leadership on CMMC opens up with a brief history starting at 7012, moving into interim rules, new admin hit pause, we are moving into rule making

When we hit the "strategic pause" and launched a "TIGER TEAM" who had a bunch of meetings to get us to where we were when we started in 2017.

"we are currently working through the requirements to determine what controls from 172"

we are working with industry to make sure the "juice is worth the squeeze"

There is a potential that if you handle non-prioritized you can still self-assess with a yearly affirmation, level 2 will be C3PAO, level 3 will be done by DIBCAC. They will do the delta above 171.

Stacy S. Bostjanick, "The difference between the two level twos" will be in the solicitation.

Someone asked, "I don't know if it will be priortized before solicitation. So how do I prepare."

Stacy S. Bostjanick, "We are currently tabletopping to decide what is prioritized."

NARA has 126 categegories. DoD only cares about 99 and only 3 for level three. No mention of the three.

Stacy S. Bostjanick, CMMC is all about the data and which networks it will travel on. This is all about protecting the data.

What we have noticed from advesaries they do not go after the prime they go after subs

Stacy S. Bostjanick in replying to Ryan Bonner notes CTI and ITAR will not be non-prioritized CUI

Stacy S. Bostjanick: CMMC is in Groundhog Day. We estimated 9-24 months but the 9 months gone now. My guess we get 32 in by July.

When 32 is in they will ask for an interim while 48 gets published.

30-90 days after 48 interim rule 7021 will start to show up in contracts.

Stacy S. Bostjanick: "We wanted to offer early certifications and awards but legal counsel said...hold up we don't know what rule making says" ......so I guess early adoption up in the air.......

Stacy S. Bostjanick brings up waivers as possibly a tool for start ups. .....I highly doubt waivers will get applied to start ups.