{"id":37512,"date":"2019-09-10T20:29:37","date_gmt":"2019-09-10T20:29:37","guid":{"rendered":"https:\/\/one.sightlinemg.com\/defensenews\/uncategorized\/2019\/09\/10\/what-does-state-of-the-art-cybersecurity-look-like-to-the-pentagon\/"},"modified":"2026-08-08T18:23:24","modified_gmt":"2026-08-08T18:23:24","slug":"what-does-state-of-the-art-cybersecurity-look-like-to-the-pentagon","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/defensenews\/pentagon\/2019\/09\/10\/what-does-state-of-the-art-cybersecurity-look-like-to-the-pentagon\/","title":{"rendered":"What does state-of-the-art cybersecurity look like to the Pentagon?"},"content":{"rendered":"\n

The Department of Defense wants to hear from industry leaders about the Pentagon\u2019s proposal to grade contractors on their cybersecurity.<\/p>\n\n\n\n

The Defense Department is focusing on the cybersecurity of its suppliers. According to experts, while DoD requires compliance with certain standards released in 2017 from the National Institute of Standards and Technology, many companies blew past those deadlines and requirements.<\/p>\n\n\n\n

Now, DoD is rolling out what it calls the Cybersecurity Maturity Model Certification, a framework that grades companies on a scale of one to five. A one designates basic hygiene and a five represents advanced hygiene. The scale is flexible, officials said, and will adapt over time. Right now, Pentagon leaders want input from companies on what controls work and which don\u2019t.<\/p>\n\n\n\n

Feedback is due before Sept. 22.<\/p>\n\n\n\n

\u201cSince it\u2019s a collaboration, with over 7 percent of my data on your networks, it\u2019s no longer a me-or-a-you thing, it\u2019s a we thing,\u201d Katie Arrington, chief information security officer for the Office of the Under Secretary of Defense for Acquisition, said at the Billington Cybersecurity Conference in September. \u201cI need to know what [controls] are not useful and how you would take that control and make it a requirement,\u201d she said.<\/p>\n\n\n\n

For example, the Pentagon wants to know the best ways to measure access control and multifactor authentication.<\/p>\n\n\n\n

Understanding the threat<\/b><\/p>\n\n\n\n

The defense industrial base has long been a target for foreign espionage. U.S. government officials have said that while much of the information breached in the past several years from private businesses was not classified by itself, in aggregate, the data revealed a great deal of sensitive information about military programs.<\/p>\n\n\n\n

Moreover, many small companies far down the supply chains of large defense primes lack even basic cybersecurity and in some cases don\u2019t even have IT personnel.<\/p>\n\n\n\t