Mark Bartlett

GSA is quietly raising the bar for contractors handling CUI. The new GSA CUI Guide appears to apply to any contractor whose non-federal systems store CUI—similar in scope to CMMC for DoD contractors. But there’s a catch: the Guide only becomes binding when it’s explicitly incorporated into a solicitation or contract and approved by GSA’s OCISO and CISO. How broadly will GSA roll this out? That’s still unclear—but we’re expecting increased attention on the Guide and its requirements. If you’re bidding on or managing GSA work, start scanning solicitations and contracts for references to the “GSA CUI Information Systems Guide.” Stay proactive: review your current CUI controls now so you’re not scrambling later when these requirements start showing up more frequently. https://hubs.ly/Q0431ZMD0

2

🚨 The DoD has published the CMMC Final Rule! 🚨 📅 Effective Date: November 10, 2025 🚀 Phased Rollout Begins CMMC requirements will start appearing in contracts gradually. 🛡️ Who’s Impacted: Any contractor or subcontractor handling FCI or CUI. Now’s the time to get ready. Conduct readiness assessments, build a compliance plan, and make sure you’re prepared for when these requirements show up in contracts. 📖 Full rule: https://hubs.ly/Q03HH-l70 Cybersec Investments is ready to help your organization with every step of the compliance process. #CMMC #DFARS #DoD #Cybersecurity #FederalContracting

63

6 Comments

❗ CMMC Final Rule (DFARS 252.204-7021): Roles & Responsibilities The newly finalized CMMC rule defines how compliance responsibilities are shared across DoD contracting officers, prime contractors, and subcontractors. Here’s a quick breakdown. The attached diagram by KLC Consulting - Authorized CMMC C3PAOgives you a simpler view. 🔹 DoD Contracting Officers - Apply CMMC requirements from the Program Office - Verify prime contractor’s CMMC UID(s) and status in SPRS before award - Confirm annual affirmations and track system changes or new UIDs 🔹 Prime Contractors - Maintain continuous compliance (annual affirmations, system change notifications, new UIDs) - Flowdown CMMC requirements to subcontractors - Verify subcontractor CMMC UID(s) and status (typically via screenshots since primes lack direct SPRS access) 🔹 Subcontractors - Maintain continuous compliance with annual affirmations - Report system changes or new CMMC UIDs to the prime (‼️not directly to DoD - CMMC Final Rule excludes this requirement for subs to report to the DoD Contracting Officer (DFARS 252.204-7021 (f)) 👉 Key takeaway: CMMC is a shared responsibility. Contracting officers verify compliance, primes manage and enforce compliance across their supply chains, and subs must stay compliant and transparent with their primes. At KLC Consulting - Authorized CMMC C3PAO, we help both primes and subs navigate these requirements with clarity and confidence. For CMMC Level 2 Certification Assessment: Get an instant price quote: https://lnkd.in/gemXXxPM KLC Consulting, Inc. cmmc@klcconsulting.net https://klcconsulting.net #CMMC #DoD #Compliance #Cybersecurity #ContractManagement #PrimeContractor #Subcontractor #DFARS #SPS #SPRS #CMMCUID #CybersecurityCompliance #DefenseContracts #RiskManagement #InformationSystems #ContinuousCompliance #CUI #DIB Kelly Hynes McDermott Maureen Casassa Renee Precopio Paul Casassa Layla Paoletti John "Lt" Sciandra CISSP, CMMC Lead CCA/Instructor Carter Schoenberg Derek Kernus Derek White Levi Kapilevich Patrick Colantonio Carter Schoenberg Chris Wolski, MBA, CISSP, GICSP, Lead CCA ⚡️Jil Wright Brian Hubbard Amira Armond George Perezdiaz Stacy Bostjanick George Dunlop Richard “RJ” Williams James Goepel Stuart Itkin Joy Belinda Beland Gus Sanchez Michael Snyder Vincent Scott Kenneth Squires Jacob Horne Derrich Phillips, Lead CMMC Certified Assessor (CCA)

105

6 Comments