On Jan. 31, the Department of Defense (DoD) released version 1.0 of its Cybersecurity Maturity Model Certification (CMMC) framework, which will require third-party cyber audits for the 300,000+ companies that provide products and services to the department. If you are a defense contractor or subcontractor, the CMMC will apply to you. <\/p>\n\n\n\n
Furthermore, despite the recent tumult precipitated by the spread of COVID-19, the Pentagon has made clear that the CMMC rollout is a critical priority. <\/p>\n\n\n\n
What does this mean for your business? Let\u2019s take a look: <\/p>\n\n\n\n
First, some background. Following a series of high-profile breaches and security leaks, cybersecurity has emerged as a top priority for our nation\u2019s supply chain. The CMMC was created to combat advanced persistent threats (APTs) perpetrated by increasingly sophisticated actors. The stakes could not be higher than for members of the defense industrial base (DIB \u2013 aka DoD contractors), where security vulnerabilities aren\u2019t just organizational threats; they may compromise our national security. In response, the DoD has issued the CMMC.<\/p>\n\n\n\n
So, what is the CMMC? The CMMC is a certification process that measures a DoD contractor\u2019s ability to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Unlike previous models, contractors cannot self-certify their compliance with the CMMC. Instead, contractors and their subcontractors will need to pass a CMMC audit conducted by an independent third party before bidding on new contracts.<\/p>\n\n\n\n
What does the CMMC require and is it retroactive? <\/b>Version 1.0 of the CMMC requires DoD contractors to obtain a rating, from Level 1 through Level 5, measuring cybersecurity maturity across 17 domain areas. Level 1 certification involves 17 basic cyber hygiene practices, such as implementing antivirus software and regularly updating passwords. At the other end, Level 5 covers 171 practices as well as accompanying capabilities and processes. Each level builds on the previous one, adding more cybersecurity capabilities, practices and processes for contractors to follow. Level 3 is roughly equivalent to the National Institute of Standards and Technology (NIST)\u2019s existing SP 800-171, while Levels 4 and 5 add further proactive and advanced cybersecurity practices. <\/p>\n\n\n\n
Contractors will be able to identify the CMMC level required for a contract in RFP sections L and M and use that as \u201cqualification-to-bid\u201d criteria in the proposal process. This assures the DoD that a contractor and its subcontractors can adequately protect FCI and CUI at a level commensurate with a given project.<\/p>\n\n\n\n
The requirements will not be retroactive to current contracts. <\/p>\n\n\n\n
How will this apply to subcontractors?<\/b> The CMMC applies to DoD subcontractors. However, the level required of a contractor won’t necessarily apply to a subcontractor on the same contract. Instead, it will depend on that subcontractor’s role and the information it needs from the prime contractor. Defense contractors and subcontractors at all levels will need a certification, as adversaries often target lower-tier suppliers rather than more sophisticated primes \u2013 making compliance at all links in the supply chain necessary.<\/p>\n\n\n\n
Explain the third-party certification requirement. <\/b>Third-party CMMC verification is required and, according to the DoD, will last for three years. Third-party assessors haven\u2019t been selected yet, but the accreditation body formed to oversee the training and administration of the assessors and is moving quickly. <\/p>\n\n\n\n
Critical dates.<\/b> CMMC requirements are slated for inclusion in some requests for information beginning June 2020, with corresponding contract solicitations following in September. The number of DoD contracts with accompanying CMMC requirements will only increase over time, and all new contracts will include a minimum cybersecurity requirement by fiscal year 2026. <\/p>\n\n\n\n
Preparing for an audit and getting certified.<\/b> DoD contractors are strongly advised to learn as much as possible about the CMMC to proactively prepare and ensure readiness. One resource to tap is the CMMC Accreditation Body, which is conducting a series of webinars designed to help contractors and prospective auditors familiarize themselves with the new requirements. <\/p>\n\n\n\n
It is also highly recommended that contractors conduct a CMMC self-assessment using the published requirements or, for a more user-friendly version, using an online assessment tool. This allows contractors to easily identify gaps and implement remedial measures. <\/p>\n\n\n\n
As you embark upon this journey, it\u2019s worth ensuring that you maintain a strong repository of clear and easily accessible documentation, as your next step will be to engage a third-party assessor and seek certification. This will streamline the audit process and help keep your costs down.<\/p>\n\n\n\n
You know the old idiom, \u201cthe early bird catches the worm?\u201d Well, it rings true in this scenario. Don\u2019t get left behind \u2013 start taking steps now to ready your business for these new requirements, and you won\u2019t find yourself scrambling this summer. Early preparation not only helps you stay ahead of the competition; it can help limit the risk our nation\u2019s supply chain and better protect our national security.<\/p>\n\n\n\n
Melissa Koch is cofounder and chief executive of InFront Compliance, which provides online compliance assessment and reporting tools built to reduce risk in our nation\u2019s supply chain.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
By taking steps now, contractors can be ready for new cybersecurity requirements from the Pentagon.<\/p>\n","protected":false},"author":7,"featured_media":54014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[7677],"class_list":["post-28020","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"5E4S4G4IPNBQPBVLDAUYWNSOLE","arc_canonical_url":"\/thought-leadership\/2020\/04\/28\/why-defense-contractors-should-fear-falling-behind-with-new-cyber-standards\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n