SAN FRANCISCO \u2014 The Department of Defense official leading the overhaul of cybersecurity requirements for the Department of Defense contractors sees the model as being in a \u201cconstant state of evolution\u201d over the next few years.<\/p>\n\n\n\n
Katie Arrington, the chief information security officer for the Office of the Under Secretary of Defense for Acquisition and czar for the new Cybersecurity Maturity Model Certification, told Fifth Domain in an interview at the RSA Conference that work on CMMC will be a \u201cperpetual thing.\u201d<\/p>\n\n\n\n
After the CMMC requirements are written into contracts around October, Arrington said she wants to \u201chave some data to say \u2018okay, these controls \u2014 are they really worth the return on investment? Do we need to tweak the model?\u2019\u201d<\/p>\n\n\n\n
CMMC 1.0 was released at the end of January.<\/p>\n\n\n\n
Right now, Arrington said, she is working with staff to create the audit training. One of the challenges in building the training, like creating CMMC itself, is ensuring that it is simple and easy to understand.<\/p>\n\n\n\n
Beyond CMMC, Arrington said that the \u201cnext big thing\u201d she\u2019s going to work on is supply chain illumination tools and adding continuous monitoring into “… those most vulnerable in our supply chain and the ones that are working on the most critical technologies,\u201d she said. \u201cI need to know how they\u2019re doing acting day-to-day, how their supply chain looks.\u201d<\/p>\n\n\n\n
Arrington also told Fifth Domain that she expects CMMC to be adopted internationally in 2020 and 2021.<\/p>\n\n\n\n
\u201cOur Five Eyes partners are like, \u2018hey, we\u2019re right here with you,\u2019\u201d she said.<\/p>\n\n\n\n
With the federal government facing constantly evolving attacks on its supply chain, Arrington said that CMMC needs to be able to adjust to new challenges.<\/p>\n\n\n\n
\u201cIf it becomes a checklist, we have all failed,\u201d she said. \u201cIt needs to become critical thinking about security and understanding that the threat today will not be the same threat that\u2019s here a year or two years from now. And that we have to be constantly looking at how do we tweak? How do we bob? How do we weave?\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Katie Arrington, CISO for the Office of the Under Secretary of Defense for Acquisition and czar for the new Cybersecurity Maturity Model Certification, told Fifth Domain her thoughts on CMMC’s \u201cconstant state of evolution.\u201d<\/p>\n","protected":false},"author":7,"featured_media":27541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":13,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10,106,29,13,32],"tags":[],"coauthors":[3252],"class_list":["post-17955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-industry","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"W3CVVFFQJJDUJCDSDZW5TU7TE4","arc_canonical_url":"\/dod\/2020\/02\/28\/the-future-of-defense-contractor-cybersecurity-standards\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n