Sir, we just discovered that we have the DFARS 7012 clause in our contract. This is going to affect our supply chain throughout the United States.

We didn’t see it in our contracts before, but this is something that we must do, especially our suppliers in Ohio and Texas.

When do we need to submit our SPRS score?

Sir, we....

We already submitted an SPRS score of 110.

But we are still missing a system security plan.

Everyone leave except Vice Presidents Keitel, Jodl, Krebs, and Burgdorf.

HOW COULD THIS HAVE HAPPENED?!

I want to know who submitted the SPRS score!

It says it in the DoD Assessment Methodology, plain as day, that the absence of a system security plan would result in noncompliance with DFARS 7012.

Even I know that and I'm the CEO.

How do we not have a system security plan after all these years?

What if the contracting officers or our primes find out about this?

And what is the status of our POAM? I have so many questions about our compliance.

Sir, we used the DoD Assessment Methodology.

But did you assess our environment with NIST 800-171A?

Sir, we've never heard of such a document.

Of course not. You could have found it on the NIST website under the section "Other Parts of this Publication"

We now have to develop a system security plan as soon as possible.

DIBCAC has stated they are going to begin Medium assessments in the near future.

Is our controlled technical information marked? Are we using FIPS-validated encryption?

Have we set up a logon banner on our systems?

But most importantly, have we implemented multifactor authentication for local and network access on our systems?

These are the questions that DIBCAC will be asking not just of us, but our suppliers.

Do we have to report this to DIBNET?

Let me guess: we never acquired a DoD-approved medium assurance certificate.

Are we sure we only have controlled technical information and not export controlled information?

Because that will be a game-changer.

Have you seen the list of additional requirements in the CUI Registry?

Most importantly, we need to do a walkthrough and make sure all media has been marked in accordance with DoDI 5200.48.

It's ok. You marked the media correctly.

DFARS 7012 is a beast.

There is a lot more to do than just NIST 800-171.

But it's not impossible.

We should start by checking our inventory.

Please tell me we documented our hardware and software inventory and separated them by asset category.

Because I don't know how much more of this I can take.

That's all I got.