cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
N_Bakewell
Newcomer II

CMMC and International Business Units

Good morning all,

 

I have yet to find any clarifications from the CMMC-AB about how it will handle assessing US companies with international business units that take part in US DoD contracts (under ITAR agreements), when the enterprise network shares resources and systems across the globe.  My presumption would be that, if the offshore business unit touches CUI/FCI (which, if it is taking a part of a DoD contract, almost a definite), it falls under the umbrella of needing to be assessed, but part of that assessment is also* a physical on-site evaluation.  Has anyone heard anything to clarify this?

 

*This is actually a presumption as well, since the CMMC-AB has not specified.