Events

Companies seeking to begin or continue doing business with the Defense Department must be at least CMMC Level 1 certified. Cyber security compliance is now the foundation under the three statutory evaluation factors of technical, past performance and price. Preparing for, implementing and ultimately obtaining CMMC certification is time-consuming (6-9 months) and can be expensive depending on the CMMC Level sought. Prudent contractors should examine and confirm if their NIST-based System Security Plan is sufficient (and at what “certified” level) for current and future contract obligations.

Your company’s level of “cyber hygiene” will directly impact your eligibility to contract or subcontract with the Defense Department (and likely with some non-DoD agencies) as well as impact your competitive posture anywhere in the DoD supply or service chain.

In this Program, you will learn about:

• The CMMC – DoD implementation schedule;
• The Federal cybersecurity vocabulary: CUI, FCI, CCI;
• CUI marking obligations by government personnel and contractor personnel
• How CMMC “Level 1” effectively applies to all federal agencies;
• The requirements of DFARS 252.204-7012 and the interim DFARS 252.204-7019, 7020, and 7021 clauses;
• DoD’s Assessment Methodology;
• The Supplier Performance Risk System (SPRS);
• The DoD guidance available to achieve CMMC Level 1;
• The available self-assessment programs;
• The requirements under [Draft] NIST SP 800-172 contained in CMMC Level 3 to address Advance Persistent Threats;
• Cybersecurity as a contractor qualification (the CMMC Level) versus an evaluation factor (the quality of a System Security Plan);
• CMMC, the Cloud and FedRAMP;
• The fundamentals of cybersecurity training;
• The government-wide supply chain obligations regarding Chinese sources
  • • DoD guidance
    • GSA guidance
• DoD supply chain obligations regarding Chinese and Russian sources
  • • DoD guidance

Instructors:

David Dempsey, co-founder and partner at Dempsey Fontana, PLLC, with over 42 years of experience in procurement laws, regulations and policies pertinent to contracting with federal, state, and international agencies. David’s practice areas include rights in technical data and software; cybersecurity requirements and obligations; DCAA audits, cost principles; ITAR/EAR export controls, foreign and contingency contracting; OCIs, ethics and corporate compliance; small business size issues; IDIQ contracts; contract management and terminations; Service Contract Act issues; contract litigation and bid protests.

Melissa Ellis is co-owner of Systems Management Enterprises, Inc. (SME) where she is Vice President and CFO. SME is a Virginia Information Technology and Security Company providing data center services, managed security, compliance solutions, and technical support to businesses nationwide. Melissa focuses on cybersecurity training for businesses in the financial, medical, and professional services industries.  Over the past several years she has worked within these industries to assess and implement company-appropriate information security compliance initiatives and then followed up with information security awareness training. Melissa’s background includes Criminal Justice at Radford University and is a Certified HIPPA Professional and a Certified Security Awareness Practitioner (CSAP). Melissa develops and implements cybersecurity training programs for all types of business entities and passionately educates her trainees on how to understand and implement the “cyber hygiene” behavior necessary to safeguard company intellectual property and trade secret data.