What we’re talking about
The Bureau of Industry and Security (BIS) has issued new guidance for Advanced Computing ICs in an effort to prevent diversion of electronics that could be implemented in Weapons of Mass Destruction (WMD). The BIS also updated Supplement No. 3 to Part 732 “Know Your Customer” Guidance and Red Flags to provide a due diligence
DoD Acquisition nominee Michael Duffy plans to review Cybersecurity Maturity Model Certification (CMMC) implementation in an effort to balance a need for security and excessive regulation. Duffy also recognized the need for affordability for the Defense Industrial Base (DIB) to maintain cybersecurity best practices to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Duffy
Recent studies have shown that organizations are not ready for CMMC. The Aware but not Prepared report from Redspin states that only half of the Defense Industrial Base (DIB) are even moderately prepared for a Level 2 certification. Despite a five year roll out for the final rule from the Department of Defense (DoD) DIB
The International Trade Administration (ITA) has released the 2025 Defense Export Handbook to provide an overview of U.S. trade laws governing the export of defense products. This handbook also gives guidance to new-to-market exporters on evaluating international markets and includes contact information for export control, trade promotion, and licensing. The publication describes U.S. statutes that
Integrated business management systems provide more effective solutions to the challenges facing organizations today. This approach consolidates business processes and systems across teams and unifies objectives. It can effectively address requirements for quality management, export compliance, information security management, and other concerns, ensuring compliance without gaps, duplication of efforts, or teams working at cross purposes.
The Department of Defense (DoD) has released its Cybersecurity Maturity Model Certification (CMMC) final rule. This rule will now require contractors to verify that required security measures have been implemented for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). These requirements will are to be implemented in early to mid-2025 when verification of security
AUKUS Pillar I and Pillar II ITAR developments continue as the U.S. responds to national security threats with strategic trade controls and security partnerships. In recent news, AUKUS Pillar II has greatly eased the transfer of defense articles and technologies between Australia, the United Kingdom, and the United States. This trilateral security partnership was created
The Bureau of Industry and Security (BIS) has expanded its Validated End User (VEU) Program to include controls for data centers in an effort to create a trusted ecosystem for artificial intelligence (AI) development. The VEU will now review applicants data centers to ensure application of appropriate safeguards and security measures. This update to the
Ransomware may have been the possible cause of death of a patient in Dusseldorf. A ransomware attack on thirty servers at the Dusseldorf University hospital on September 9, 2020 prevented immediate emergency treatment and resulted in the patient having to be transported to a facility 20 miles away where she died from a delay of
The Bureau of Industry and Security (BIS) has amended the Voluntary Self Disclosure (VSD) process in the Export Administration Regulations (EAR). The newly released amendment to CFR 15 Section 764.5 and Supplement No. 1 to part 766 provides guidance for settlement determinations of penalties for administrative enforcement cases. This action evolved from a series of
The Department of Defense (DoD) has proposed a Defense Federal Acquisition Regulation Supplement (DFAR) amendment for contractor implementation of Cybersecurity Maturity Model Certification (CMMC). DFARS case 2019-D041 was first published in September 2020 with an effective date of November 20, 2020 to allow for the development of CMMC 2.0. CMMC 2.0 establishes a framework for
A suit filed against Georgia Tech by the United States Government alleges that the university’s affiliate, Georgia Tech Research Corporation (GTRC) knowingly failed to meet its cybersecurity requirements for the Department of Defense (DoD). The suit was initiated by a whistleblower complaint from members of Georgia Tech’s Cybersecurity team. The lawsuit alleges that the Georgia
The U.S. Department of State announced on August 15, 2024 that progress had been made in the AUKUS defense trade integration. This has resulted in an interim final rule amendment to the International Traffic in Arms Regulations (ITAR) that will facilitate billions of dollars in secure license-free defense trade between Australia, the United Kingdom, and
The Bureau of Industry and Security (BIS) has released guidance on improving academia research export compliance programs. This guidance is based on recent trends in Voluntary Self-Disclosures conducted by academic institutions where Export Administration Regulations (EAR) violations occurred . Voluntary Self-Disclosures A Voluntary Self-Disclosure (VSD) is conducted when an organization recognizes that violations or suspected
Integrating physical security requirements is an area of growing concern for organizations of all sizes. Aside from insuring basic safety for personnel and physical assets, businesses are faced with security requirements for cybersecurity and export compliance. This necessitates a non-siloed approach to an often overlooked management function. Basic Physical Security Measures Every organization should ensure
The Bureau of Industry and Security (BIS) has issued guidance that recommends using a new export screening list as additional due diligence to prevent diversion risks. This new database, The Trade Integrity Project has been released by the Open Source Center, which is based in the United Kingdom. This list focuses on entities involved in
