5 ms·
> Contractors like Penn State are required to self-attest to compliance with 110 security requirements spelled out by the National Institute of Standards and Te
by entuno 3y ago
> Contractors like Penn State are required to self-attest to compliance with 110 security requirements spelled out by the National Institute of Standards and Technology; there is no oversight, Newman wrote.
> The self-reported scores must be submitted before a defense contract is renewed or awarded. At least 20 records submitted to the government were falsified, the lawsuit alleged.
If you're not going to do any actual verification of the security of a subcontractor and just ask them to "self assess", with a significant financial incentive for them to lie to win a contract, you can't be too surprised when they....lie to win the contract.
- rplst8 3y agoYeah but when you find out they lied, you can't just look the other way. People and organizations shouldn't need the threat of oversight to be honest.
- zamadatix 3y agoI'd even take it a step further, when a contract worth 2 billion is awarded without even an attempt at validation of self compliance claims then the ones in control of the awarding process are also part of the, almost guaranteed, fraud.
- ipunchghosts 3y agoThe title is wrong. The 2b has nothing to do with the fraud. 2 completely different organizations with sperate IT systems.
- zamadatix 3y agoThat is excellent information, thank you!
- dralley 3y agoThey should be made to self-assess, and then audited anyway. The accuracy of their self-assessment should be part of the selection criteria.
- twarge 3y agoIf this is just the standard CMMC clause getting inserted with all government contracts, then they are not actually required to meet all the security standards all at once. They only have to have a plan to meet all the standards. So saying that you are compliant when you aren't here is not a requirement for a contract. It's just lazy.
- notesinthefield 3y agoUntil you have outside confirmation, we attest via SPRS[1] which requires more detail than just checking a box and holds legal constraints against falsification, a lot of DoD contracts renew March-June and the drop dead for CMMC for DoD suppliers is 2025. You will hear about this falsification happening more and more (especially around pentest reqs) , without a dedicated implementation team compliance is hard for already understaffed universities. It is the least interesting place to be for infosec work. [1]https://www.sprs.csd.disa.mil/ https://www.sprs.csd.disa.mil/
- 3np 3y ago"We" being?
- notesinthefield 3y agoWeird language, sorry
- mcpackieh 3y ago> you can't be too surprised when they....lie to win the contract. Whether or not you can be "surprised" you can still hold them legally accountable for it. Surprise or lack-thereof is irrelevant, so why even bring it up?