CMMC 2.0 is Here: An Update on the DoD's Cybersecurity Requirements

REGISTER
Date
- (12:00 - 1:00pm CST)

 

Do you do business with the U.S. Department of Defense (DoD)? Have you heard about the latest update to the Cybersecurity Maturity Model Certification (CMMC)?

To help IPC member companies cut through the noise and confusion surrounding the CMMC update, IPC is hosting a free, one-hour webinar on Thursday, December 9 at 1:00 pm EST.

In this webinar, CMMC expert Leslie Weinstein, U.S Army Reserve, will review:

• A detailed breakdown of the changes that have been announced from CMMC 1.0 to CMMC 2.0
• Updated timelines for compliance
• Getting prepared: Steps you need to take now
• Resources available to you

You will leave with an understanding of the changes introduced by CMMC 2.0 and be better equipped to navigate the evolving CMMC landscape.

Online Event

3000 Lakeside Dr.
Suite 105N
Bannockburn, IL 60015
United States

Online Event

Online Event
3000 Lakeside Dr.
Bannockburn, IL 60015
United States

REGISTER

Cybersecurity Maturity Model Certification: Key Benefits

Nov 09, 2021

By Leslie Weinstein, Specialist Leader for Cybersecurity, Deloitte, Member of the IPC Thought Leaders Program

On November 4, the U.S. Department of Defense (DoD) unveiled a much-anticipated update to its Cybersecurity Maturity Model Certification (CMMC) program — called CMMC 2.0 — and electronics manufacturers will want to take note of the changes.

The CMMC program is the DoD's effort to bolster supply chain cybersecurity by requiring vendors to undergo third-party cybersecurity assessments. Under the original CMMC program, launched in 2020, every defense contractor was required to successfully undergo a third-party assessment of their cybersecurity program no later than November 1, 2025.

However, in an IPC survey and report released last June, 24 percent of electronics manufacturers said the costs of compliance with the CMMC could force them out of the DoD supply chain – potentially weakening the defense industrial base (DIB) while seeking to bolster security within it. 

According to the DoD, CMMC 2.0 is designed to minimize barriers to compliance by reducing costs, particularly for small businesses, and by clarifying and aligning cybersecurity requirements to other federal requirements and commonly accepted standards. To achieve this, companies within certain compliance levels will be able to conduct self-assessments in place of a third-party audit. Some companies may also be able to conduct self-assessments if there is a time-bound and enforceable plan in place to remediate any compliance gaps.

Below are the some of the notable differences between the original CMMC program and CMMC 2.0:

CMMC 1.0

CMMC 2.0

5 compliance levels

3 compliance levels:

  • Level 1 remains the same
  • Level 2 is previous level 3
  • Level 3 is previous level 5
  • Elimination of Levels 2 and 4

Level 3 required for Controlled Unclassified Information (CUI)

Level 2 required for CUI

All levels require third-party assessment

Assessment requirements vary by compliance level:

  • Level 1: Requires annual self-assessment
  • Level 2 (no information critical to national security): Requires annual self-assessment
  • Level 2 (handles information critical to national security): Requires triennial third-party assessments
  • Level 3: Requires DoD assessment

Level 3 equivalent to National Institute of Standards and Technology (NIST) 800-171 plus 20 CMMC practices and maturity processes (.999, .998, .997)

No CMMC practices or maturity processes; Level 2 will be equivalent to NIST 800-171

No gaps allowed

(100% compliance required)

  • Some gaps allowed if a Plan of Action and Milestones (POA&M) is in place
  • DoD will establish a minimum score requirement to support certification with POA&Ms
  • 45 critical controls can’t have gaps

 

So, what does this mean for manufacturers within the DIB?

Although many manufacturers may process and handle Controlled Unclassified Information (CUI), most do not handle information that is most critical to national security. As such, manufacturers will be asked to perform and submit only an annual self-assessment of their NIST 800-171 implementation.

However, this does not mean that the manufactures are off-the-hook for cybersecurity compliance. Instead, manufactures must ensure they have a plan to close those compliance gaps. While the threat of an on-site auditor to "kick the tires" has lessened, manufactures should still be ready to answer any questions regarding their compliance posture. As a reminder, the False Claims Act still applies here, and minimum scores are still required to be maintained regardless of self-assessment status. This means that the DoD will have the right to request documentation and proof of compliance at any time during the performance of a contract.

Given the many concerns that were raised about CMMC 1.0, these common-sense changes are a big improvement. IPC’s industry research report and input to a congressional hearing apparently had an impact. The DoD took IPC’s input and that of others seriously, and compliance burdens will be lessened for some of the most at-risk SMEs working within the DIB.

IPC will continue to advocate for the industry's interests in the CMMC program and will continue to help with industry compliance efforts. Stay tuned for an upcoming IPC webinar including yours truly and other experts, and please contact me or Chris Mitchell at IPC if you have questions or suggestions.

 

 

Biden Administration Implements Vaccine Mandates

Nov 05, 2021
| By Ken Schramko

by Ken Schramko, IPC senior director, North American Government Relations

In a bid to get more people in the United States vaccinated against COVID-19 and decrease the spread of the virus, the Biden administration has announced that it will enforce a new mandate on vaccinations for U.S. companies with over 100 employees.

The new mandate comes in the form of an Emergency Temporary Standard (ETS) issued on November 5, 2021 by the U.S. Occupational Safety and Health Administration (OSHA). To comply, employers must ensure all requirements of the ETS, other than testing for employees who have not completed their entire primary vaccination, are met by December 5, 2021, 30 days after publication. And employers must ensure compliance with testing requirements for employees who have not received all doses required for a primary vaccination by January 5, 2022, 60 days after publication. Employers who violate the rule can face fines of up to $13,653 per violation for serious violations and 10 times that for willful or repeated violations.

It is estimated that the requirement will apply to over 84 million employees at 1.9 million private-sector employers. OSHA estimates that 31.7 million of covered workers are unvaccinated and 60 percent of employers will require vaccinations, up from 25 percent today, resulting in another 22.7 million employees getting vaccinated.

In a related decision, U.S. President Joe Biden, on September 9, 2021, issued Executive Order (EO) 14042 that requires federal contractors to be vaccinated, but without the option of weekly COVID-19 testing. The EO is separate from the OSHA ETS, but in an EO fact sheet it noted that the OSHA ETS deadline for federal contractors to meet the vaccination requirements has also been extended until January 4, 2022.

The EO defines "federal contractor” very broadly and much is still unclear about the rule, but it directs federal agencies to ensure that contracts include a clause requiring contractors and their subcontractors to comply with all guidance for workplace locations, including vaccination of employees except in limited circumstances. The order does not apply to subcontracts solely for the provision of products, and yet, under guidance issued by the Safer Federal Workforce Task Force, federal agencies are being encouraged to make contractors flow down the vaccine requirement to all subcontractors regardless of the exemption.

IPC supports industry vaccination initiatives, among other efforts by government to protect public health. However, we are concerned about the potential overreach and lack of clarity associated with the mandates on federal contractors. 

EPA Extends PIP (3:1) Compliance Date, IPC Member Feedback Needed

Nov 05, 2021
| By Kelly Scanlon

By Kelly Scanlon, director of environmental policy and research

EPA published a new Proposed Rule to further extend the risk management compliance date for PIP (3:1)-containing articles to October 31, 2024. The prohibition on processing and distribution of PIP (3:1) and PIP (3:1)-containing articles will be effective on that date unless we can make a strong case otherwise.

Because the proposed rule highlights electronics, including wiring harnesses, cables, wiring sleeves, casings, and cords, we want to make sure that the electronics manufacturing industry is aware of the likely relevance of the 2024 prohibition.

We encourage you to review our Request for Information for a detailed list of data and documentation needed to prepare a response to EPA. IPC will continue to collaborate with CTA and ITI to gather the electronics industry’s feedback. We do not plan to oppose the newly proposed extension, but we will request to EPA that it be based on a “manufactured by” compliance date. Also, we will reiterate to EPA our earlier requests to establish an adequate de minimis concentration and to provide specific exemptions including for spare and replacement parts.

We anticipate that the electronics industry will have new or additional data and information based on its efforts to identify PIP (3:1) in its supply chain since the January 2021 final risk management rulemaking.  Also, we anticipate industry members will have more economic impact information to support a request for an exemption for spare and replacement parts. We welcome your feedback in response to the Request for Information by December 1, 2021.

Please see our earlier blog posts regarding PIP (3:1). I welcome your questions about this proposed rule and the recent history of PIP (3:1)-related policy actions.  KellyScanlon@ipc.org

IPC Issues Industry Alert on Prohibition of PIP (3:1), March 1, 2021

USEPA Announces Request for Public Input on PIP (3:1) Final Risk Management Rule, March 12, 2021

Electronics Industry Submits Comments on EPA’s PIP (3:1) Request for Public Input, May 17, 2021

PIP (3:1) Compliance Deadline Extended…At Least Two More Rules Expected, September 8, 2021

 

WHMA 29th Annual Wire Harness Conference Offers Technical Education Workshop on Federal Contract Opportunities

Participants to learn how to do business with the federal government

Representatives from the U.S. Small Business Association (SBA), Arizona District Office, will present a technical education workshop, “Selling to the Federal Government,” on February 15, from 3:00-4:30 pm, at the 2022 WHMA 29th Annual Wire Harness Conference in Tucson, Arizona. 

Speakers at the workshop will provide information about SBA resources and certification programs that help small businesses successfully identify and compete for federal contract opportunities. 

“According to the SBA, the federal government spends approximately $500 billion in contracts every year, with 23 percent of those dollars required to be awarded to small businesses,” said David Bergman, WHMA executive director.  “We look forward to learning how the SBA can help company owners in the cable and wire harness industry do business with the federal government.”

For more information on the conference including schedule, exhibition, speaker profiles, sponsorship opportunities, or to register for event, visit https://annualconference.whma.org.

 

Electronics Manufacturing Outlook Continues to Darken, Prices Increase as Component Shortage Drags On

New Global Study from IPC Finds 9 in 10 Manufacturers Report Rising Costs, Vast Majority See Lack of Qualified Talent in North America and Globally

A new global survey found that the global shortage of semiconductors and other components continues to have serious consequences for electronics manufacturers, leading to rising costs and higher prices. The survey, conducted by IPC, the global electronics manufacturing association, also found that companies continue to face difficulty in finding qualified talent, with only 15 percent of respondents indicating that the situation is improving.

“Even as sales expectations for electronics manufacturers have improved, they face increases to both material and labor costs, leading to declining inventories and increasing backlogs around the globe,” said John Mitchell, president and CEO of IPC. “The longer the shortage crisis continues unresolved, the more difficult it will be to overcome these compounding problems and return to normal.”

Among other conclusions, the survey results found that:

  • The six-month outlook for electronics manufacturing as a result of the supply chain crisis has deteriorated – again. Expectations for sales have improved but material costs, labor costs, inventories and backlogs are all expected to continue to get worse.
  • Two-thirds of manufacturers were forced to raise prices in 2021. 71% expect to have to do so again in 2022. Shortages and supply chain and other issues have led manufacturers to increase costs by an average of 14.5% this year. Firms expect to raise prices another 7-8% next year.
  • Nine in ten manufacturers report rising costs. 75% report rising labor costs, both of which have led a majority of electronics manufacturers to report profit margin decreases.
  • Electronics manufacturers continue to face a lack of skilled talent to hire, in North America and beyond. Only 15 percent of companies see the situation as improving.

“Electronics manufacturers are expecting more problems on the horizon as a result of ongoing shortages, both in terms of the six-month outlook and for expected prices in 2022, as the crisis appears to have no end in sight,” said Shawn DuBravac, Chief Economist at IPC and lead researcher on the study. “Heading into the holiday season, these issues and backlogs could have serious repercussions for consumers in the United States and beyond.”

IPC surveyed hundreds of companies from around the world, including a wide range of company sized and representing the full electronics manufacturing value chain. Survey respondents were from North America (44%), Asia (20%) and Europe (17%).

 

 

Supply Chains Continue to be Under Tremendous Pressure

IPC releases October 2021 economic outlook report

Supply chains continue to be under tremendous pressure. Container ship reliability remains stuck near all-time lows across the world. Consumer spending and business investment both slowed in the third quarter in the United States. Some of the slowdown in demand is related to limited supply and higher prices. The U.S. is not alone in seeing weaker growth. China recorded disappointing third quarter results as well. Supply chain disruptions are equally in effect for Europe too.

In addition to IPC Chief Economist Shawn DuBravac's observations, you will also find U.S. and European data on economic growth, employment, consumer sentiment, manufacturers’ sentiment (PMI), manufacturing capacity utilization and end markets for electronics in this month’s economic outlook report.

READ OCTOBER ECONOMIC UPDATE

IPC APEX EXPO 2022

Event Website
Date
-

IPC APEX EXPO is the premier event for the electronics manufacturing industry, attracting more than 9,000 professionals from 45 countries. From the industry’s leading technical conference and professional development courses to the innovation-driven exhibit floor, IPC APEX EXPO 2022 will provide you with the opportunity to exceed your usual limits as you participate in the transformation of the industry. 

San Diego Convention Center

111 W Harbor Dr
San Diego, CA 92101
United States

San Diego Convention Center

San Diego Convention Center
111 W Harbor Dr
San Diego, CA 92101
United States

Event Website

IPC Invites Industry Leaders to Submit Poster Abstracts for IPC APEX EXPO 2022 in San Diego

IPC invites researchers, technical experts and industry leaders to submit abstracts for poster presentations at IPC APEX EXPO, the industry’s premier conference and exhibition for electronics manufacturing. Poster presentation networking sessions are scheduled for February 25 from 5:00-6:00 pm; February 26 from 2:30-3:30 pm; and February 27 from 12:00-2:00 pm. For the first time ever, poster presentations will take place on the APEX EXPO show floor, maximizing the potential audience for poster presenters.

Technical poster presentations are being sought on all relevant electronics topics, including design, materials, assembly, processes and equipment, especially:

  • Factory of the Future Implementation
  • PCB Fabrication and Materials
  • Quality, Reliability, Test, and Inspection
  • Enabling Future Technologies
  • Meeting Extreme Requirements
  • Circuit Design and Component Technologies
  • Conscientious Engineering
  • Assembly Processes
  • Electronics Materials

An abstract of up to 200 words summarizing technical and previously unpublished work covering case histories, research and discoveries should be submitted by Wednesday, November 17, 2021, to https://www.ipcapexexpo.org/call-participation-poster. Poster presenters are entitled to a free one-day conference pass on January 25. And, to recognize exceptional achievement, a “Best Technical Poster” award will be presented with a USD 750 honorarium.

For more information about poster participation or other technical program opportunities at IPC APEX EXPO, contact Toya Richardson, IPC technical programs coordinator, at ToyaRichardson@ipc.org.

IPC Welcomes Language in Senate Defense Appropriations Bill Supporting R&D on Lead-Free Electronics

The U.S. Senate Appropriations Committee this week released their fiscal year 2022 defense appropriations bill, which for the first time included language supporting further research and development (R&D) into the issues surrounding lead-free electronics in mission-critical applications.

IPC and its allies have called for a five-year, $40 million investment in a public-private R&D program to support the transition of various aerospace, defense, and high-performance (ADHP) electronics to lead-free technologies. To date, Congress has provided a combined $15 million for this purpose in FY20 and FY21.

The U.S. House version of the FY22 defense appropriations bill, which was approved by the House Appropriations Committee in August, included $7.5 million for this purpose. The new Senate language makes it more likely that such funds will be allocated as the legislation is finalized.  

“The gap between commercial and defense electronics has grown as lead-free has become the norm in commercial technologies,” said Chris Mitchell, IPC vice president of global government relations. “Today’s defense electronics are now 15 to 20 years behind the commercial market in terms of the underlying technologies used, creating risks to supply chain resiliency and defense readiness. With lead-based electronics becoming more difficult and expensive for the Defense Department to procure, the transition to lead-free is imperative.

“We salute the leadership of Senate Appropriations Committee Vice Chairman Sen. Richard Shelby (R-AL) on this issue, and we call on Congress to ensure that at least $7.5 million for lead-free R&D is included in the final bill.”

IPC and its partners in the Pb-Free Electronics Risk Management (PERM) Council and the U.S. Partnership for Assured Electronics believe a sustained investment in lead-free R&D will yield more than $100 million in annual defense savings and improve military readiness and overall innovation. Participants in the R&D program include Purdue University, the University of Maryland, Auburn University, Binghamton University, Northrop Grumman, Raytheon Technologies, Lockheed Martin, BAE Systems, Boeing, Plexus, and many others.

 

 

Subscribe to