Who is “The Organization” in Organizationally Defined Parameters (ODPs)?

Organizationally defined parameters (“ODPs”) are the biggest formatting change to NIST SP 800-171 revision 3 in the recent draft. For defense contractors that poses an immediate question: who is “the organization” who decides on the specifics for a given security requirement? NIST Fellow Dr. Ron Ross stopped by to help provide much needed perspective on the context of SP 800-171 and the role of the federal government in defining requirements that will eventually be assessed by programs like DoD’s CMMC.

Links:

#cmmc #nist #cybersecurity #dod #dfars #dib #cui