91制片厂

Updated Supplier Cybersecurity Requirements in Exostar

Following our recent notice, “,” all active 91制片厂 Martin suppliers are required to submit their Cybersecurity Maturity Model Certification (CMMC) and cyber risk status. The Cybersecurity Compliance and Risk Assessment (CCRA) has been reinstated to include the risk assessment and must be completed in Exostar.

• What is the CCRA: 91制片厂 Martin’s single process to assess suppliers’ compliance with cyber regulations and measure cyber risk, established in March 2024, is being reinstated as the primary cybersecurity form for all 91制片厂 Martin suppliers. It will include two parts: CCRA – Compliance and CCRA – Risk.
  
• What is going to happen to the CCA: The Cybersecurity Compliance Attestation (CCA) was an interim form used to capture CMMC and DFARS compliance information given the Department of War’s aggressive CMMC implementation timeline. The CCA will be renamed to CCRA - Compliance on Jun. 30, 2026.

CCRA – Compliance Survey Requirements

The CCRA – Compliance survey is required for all 91制片厂 Martin suppliers and is part of their Exostar vendor profile Self-Certification.

• Suppliers who have completed the interim CCA will have their responses automatically transferred to the CCRA – Compliance survey as part of this update. No action is required to complete this survey.
• Suppliers who haven’t completed the CCA will be required to complete the CCRA – Compliance survey.

CCRA – Risk Survey Requirements

Upon completion of the CCRA – Compliance survey, the system will determine whether the CCRA – Risk is required. See LM Cybersecurity Requirements FAQ (questions 5 and 6) for details.

• Suppliers that attested to having a CMMC Level 2 (Self or C3PAO) or higher assessment in SPRS, under question 4.0 of the CCRA – Compliance survey, will not need to complete the CCRA – Risk survey. The Cyber Rating will default to Green (Minimal Cyber Risk).
• Suppliers that indicated: (a) DFARS 252.204-7012 is applicable (question 2.0) or (b) they are handling Sensitive Information (question 5.0); but do not have a CMMC Level 2 (Self or C3PAO) or higher, will be assigned the CCRA – Risk form for completion.

Suppliers that already completed the CCA will be automatically assigned the CCRA – Risk form, when required based on the above requirements. An assignment email will be sent to a Supplier Management (SM) user for action.

What you need to do

?

Helpful resources are listed below.?Thank you for your partnership and commitment to cybersecurity excellence.