What is changing, and how to tell

Predictions about this programme have been poor

Dates have moved, scope has been revised, and confident statements about what would be required by when have repeatedly turned out to be wrong. That history is worth holding in mind when reading the next confident statement, including from a vendor.

What has been stable is the substance: protect controlled information, and be able to show it.

Four sources, in order of authority

The rule as published. Changes to a federal requirement appear in the official publication of record, with an effective date. This is the only place a change becomes real.

The acquisition regulation clause. What is in your contract governs you, and clauses change on their own schedule.

The programme's own materials. Official guidance and documentation from the body running it.

Your prime contractor. Who will tell you what they intend to require, which is sometimes ahead of what is required.

Two sources that generate most of the noise

Vendor webinars. Frequently accurate and always selective, because the purpose is a pipeline. A change is presented as urgent because urgency sells.

Social media commentary. Fast, wrong at a substantial rate, and self-reinforcing. A claim repeated by twenty accounts is one claim.

Neither is worthless. Both are leads to check against the first list rather than conclusions.

Three questions about any claimed change

Is there a published rule or clause change, and what is its effective date? Does it alter what is required, or only when? And does it apply to contracts already in place or only to new ones?

Most alarming claims fail the first question. Most of the rest turn out to be about timing rather than substance, which matters for planning and not for what you should be building.

Set it up once

Subscribe to the official notifications. Ask your prime to tell you when their requirements change. Put a quarterly hour in the calendar to check the sources above. And have one person own it, which is the compliance owner.

That is enough. Suppliers who instead follow the commentary receive more information and less of it is true.

Plan on substance, not on dates

The work that is valuable regardless of what changes is the same work: know where your covered information is, control who reaches it, record what happens, and be able to show all three.

A supplier who has done that adapts to a rule change in weeks. One who has been waiting for certainty starts from nothing, and the waiting was the expensive decision.

What this blog has been arguing

Thirty entries, and the argument in most of them is the same. The difficult part of this is not the technology and not the standard. It is knowing what you actually have, making the compliant route the convenient one, giving one person the time and authority to own it, and being able to show a stranger that all of it was true over a period.

None of that is bought. Some of it is helped by what we sell, and saying which parts is the reason this site marks its own claims.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.