Vendor and agent kit
Questions to ask every cloud service and IT company that touches your shipment information or your security data, and a letter asking your agents and subcontractors for their CMMC status before you share shipment information.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
What is inside
- Questions for cloud services: FedRAMP status or equivalency evidence, the DFARS incident terms, the customer responsibility matrix, multifactor sign-in, encryption, records and leaving. Cloud security tools that hold only security data get the shorter set noted in the kit.
- Questions for your IT company: what it handles, its service description and responsibility matrix, its access, its people and incident help.
- Letter to agents and subcontractors asking for their CMMC level, status, CMMC Status Date, scope and latest affirmation, and reminding them to pass the requirement on.
How to use it
- Send part A to every cloud service that will hold, process or send DoD shipment information for you, including your moving software provider, whoever it is.
- Send part B to your IT company, if you use one.
- Send the letter before you share DoD shipment information, and again every year. If an agent's status is Conditional, follow up on its closeout within 180 days of its CMMC Status Date.
- Keep the answers with your evidence, and track them in the workbook's Providers and agents sheet.
Sources: 32 CFR 170.16, 32 CFR 170.19, 32 CFR 170.23, DFARS 252.204-7012
Next: the worked example. It is general information, not legal or compliance advice; see the disclaimer. Back to free tools.