Issue link: https://iconnect007.uberflip.com/i/1472190
32 SMT007 MAGAZINE I JULY 2022 • Having a chain of custody policy control- ling electronic and physical materials, providing traceability, handling scrap materials, and tracking finished goods that are shipped e standard also covers non-U.S. electronic design, fabrication, and assembly organiza- tions. e U.S. defense prime contractor must approve and sponsor these non-U.S. organiza- tions before any attempt to qualify this com- pany location can occur. IPC-1791 vs. CMMC 2.0 How does the IPC-1791 standard/QML pro- gram compare with the Cybersecurity Matu- rity Model Certification (CMMC) 2.0 pro- gram? Both the IPC-1791 standard/QML pro- gram and CMMC 2.0 Level 2 program require compliance to the 110 practices of the NIST SP 800-171. CMMC 2.0 is being driven by the DFARS 252.204-7012 and requires formal cer- tification by the CMMC Accreditation Body. DFARS 252.204-7012 covers cybersecurity incident reporting. e IPC-1791 standard/ QML program is being driven by a few U.S. defense prime contractors that want to make sure their supply base is vetted, and their sup- pliers are viewed as a trusted source. e IPC- 1791 standard/QML program goes into a much deeper dive with quality, SCRM, security (including compliance to NIST-SP-800-171), and chain of custody. CMMC 2.0 today focuses only on the NIST SP 800-171 for level two cer- tification. e major difference is the IPC-1791 standard/QML program is ready today for any company that supplies products and services to the DoD. It is unclear exactly when CMMC 2.0 becomes a requirement. CMMC 2.0 may happen in Q2 2023 or later. Companies can visit the CMMC website (cmmcab.org) for the most current information and developments. If you are a U.S. defense prime contractor, trust is important, as is protecting your CUI and CTI. e IPC-1791 standard, along with the 1791 QML qualification program, provides the only means today to validate that your sup- pliers are protecting your confidential infor- mation. A special thank you to Richard Snogren, IPC 2-19b committee chair, for his guidance and input. SMT007 References 1. IPC Validation Services, IPC-1791. Randy Cherry is director of IPC Validation Services. He can be reached at randycherry@ipc.org.