Good morning all,
I have yet to find any clarifications from the CMMC-AB about how it will handle assessing US companies with international business units that take part in US DoD contracts (under ITAR agreements), when the enterprise network shares resources and systems across the globe. My presumption would be that, if the offshore business unit touches CUI/FCI (which, if it is taking a part of a DoD contract, almost a definite), it falls under the umbrella of needing to be assessed, but part of that assessment is also* a physical on-site evaluation. Has anyone heard anything to clarify this?
*This is actually a presumption as well, since the CMMC-AB has not specified.
