Understanding the Authority of CO's Versus COR's

Dana Delano, Northern Maine APEX Counselor

A recent conversation with a local federal government contractor brought to my attention the confusion on the typical ‘line of command’ when it comes to the authority of Contracting Officers versus the Contracting Officer Representative. Any misstep by either of these positions or you, the contractor, can lead to devastating results. Let’s take a look at each position’s roles and authority during a contract’s performance.

The Contracting Officer (CO) is the official ‘face’ of the Government to the contractor. The Contracting Officer is the U.S. Government's authorized agent for dealing with contractors and has sole authority to negotiate, award, administer, modify, or terminate contracts and make related determinations and findings on behalf of the U.S. Government. The CO has the authority to direct a contractor to take an action not in a contract that will cause the Government to incur additional costs.

Most Contracting Officers are not technical experts; therefore, they depend on others to be their ‘eyes and ears’ out in the field. The Contracting Officer Representative (COR) keeps COs informed so that COs can make informed decisions concerning contract performance and authorizations. As the CO's representative, they ensure proper implementation of requirements, monitor the technical efforts being performed under the contract, and are responsible for the day-to-day administration of a contract, ensuring performance issues are verified and documented. Contractors should be aware of the fact that, at times, the CO and the COR work in different physical locations, for which both parties must communicate effectively.

A contractor will communicate most often with the COR, who is representing the CO’s and the Governments interest. However, and this is important to know and understand, the COR is NOT authorized to make changes to a contract or give permission to anything outside the agreed upon contract terms and conditions or Scope of Work. Unless changes or modifications to the contract are put in writing by the Contracting Officer, it is not an authorized change and can create misunderstandings and potential hardships for the contractor.

If you have questions concerning government contracting, contact your local APEX Counselor; it is what we do.

Cybersecurity and CMMC 2.0 Awareness/Implementation is Here Today!

Christopher Paradis, Maine APEX Accelerator Counselor

With companies facing increasing cyberattacks, cybersecurity; the practice of protecting systems, networks, and programs from digital attacks has become a hot button issue for the U.S. Department of Defense (DOD) and the Federal Government.

These ongoing attacks target accessing, changing, destroying or stealing sensitive information with a goal of extorting money via ransomware or interrupting normal business operations, and most importantly potentially putting U. S. National Security at risk.

Unfortunately, implementing cyber security measures are no longer viewed as optional but mandatory for America’s business community. Companies that prioritize cybersecurity as part of their business operations are better positioned than their competitors in the marketplace, which allows them to focus on their core competencies required to produce and deliver their products and services. In addition, having a robust cybersecurity system and implementing CMMC 2.0 (Cybersecurity Maturity Model Certification) will soon be mandatory to do business with the DOD & U.S. Government.

With this in mind, let’s take a brief look at what the CMMC 2.0 Model looks like.

CMMC 2.0 consists of three levels of cybersecurity that define the individual standards a company must implement and achieve to gain certification. The required level is determined primarily by the types of information a company manages described in terms of being Foundational, Advanced or Expert and further defined as FCI, CUI or CUI+CDI.

Level 1-Foundational: FCI = Federal Contract Information

Level 2-Advanced: CUI = Controlled Unclassified Information

Level 3-Expert: CUI+ (CDI) = Covered Defense Information

The main difference between CUI and FCI is that while both types of data need to be protected, CUI is more sensitive than FCI. As a result, CUI/CDI requires additional safeguarding as the loss of this type of data could result in a risk to national security.

Considering the time, money, and resources needed to implement and maintain CMMC 2.0 standards and a robust cybersecurity system, the DOD/Government realizes this is not a quick overnight process but an ongoing one to be achieved and sustained for the long-term.

Aware that CMMC 2.0 will be mandatory, companies should not be waiting to start their cybersecurity journey by taking actions to increase their knowledge of the CMMC 2.0 Model and it’s elements/standards, explore potential cybersecurity resources and professional assistance, becoming aware of CMMC 2.0 implementation time-line developments and most importantly working to determine the types of information: FCI, CUI, or CUI/CDI the company handles now and is anticipated to handle in the future.

With companies starting to experience some “heart burn” over the impact that CMMC 2.0 may have on existing and future contracts, they need to be able to show they are actively working to develop a general cybersecurity game plan and strategy based on their identified specific needs. The key is to be able to demonstrate to the DOD and U.S. Government continuous progress and implementation milestone attainment on your cybersecurity journey/plans required to maintain a viable contracting relationship.

Cybersecurity and CMMC 2.0 awareness/implementation is here to stay and warrants a clear call to action for companies to start their cybersecurity journey today and your Maine APEX Accelerator team can help identify a number of invaluable cybersecurity resources to help get you on your way.