Each year breaches to supply chains containing controlled unclassified information (CUI) costs the U.S. economy 600 billion dollars per year. As a response to the exfiltration of data, the Department of Defense (DoD) created the Cybersecurity Maturity Model Certification (CMMC) to “serve as a unified standard for cybersecurity that will be incorporated as a ‘go/no-go’ requirement for DoD acquisitions.” Several sources were used in the formulation of CMMC including NIST SP 800-171, the Aerospace Industries Association’s National Aerospace Standard 9933, as well as Australia and the United Kingdom’s cybersecurity models, among others.
On January 31, 2020 Ellen Lord, Under Secretary of Defense for Acquisition and Sustainment, Kevin Fahey, Assistant Secretary of Defense for Acquisition, and Katie Arrington, the Chief of Information Security Officer for the DoD held a press conference to discuss the release of CMMC Version 1.0 and the anticipated timeline of its rollout. Shortly after the press conference concluded, CMMC Version 1.0 was officially released.
While significant updates have been made to previous draft releases of CMMC, the structuring and framework of CMMC remains the same. Two of the most notable changes that have been made include:
The implementation of CMMC will occur at a slow pace; the DoD does not anticipate CMMC to be fully implemented until the 2026 Fiscal Year. The DoD will be selecting third-party accreditation vendors this year that will be called “C3PAOs” to provide CMMC accreditation services to contractors and subcontractors, in addition a new Defense Federal Acquisition Regulation Supplement (DFARS) regulation is expected as early as this spring. CMMC requirements will be added to ten procurements at the end of 2020, at the time of award all contractors and subcontractors will be required to meet all applicable CMMC requirements.
In addition, the January DoD briefing offered further insight into what will be called the Accreditation Body. It is expected to “consist of 13 members from the defense industrial base, cybersecurity community, and academic community who self-nominate to join”. The responsibility of the Accreditation Body will be to monitor quality, training, and administration of the C3PAOs. The names of members have not been released at this time, but it was confirmed that there is a Board of Directors and a Chairman that has been elected. The DoD is working to draft a memorandum of understanding with the Accreditation Body that will address any conflicts of interest due to the sensitive nature of information that the Accreditation Body and auditors will have access to, as well as roles and regulations they must abide by.
DoD officials also addressed operational questions regarding CMMC Version 1.0 implementation:
While the DoD addressed several questions surrounding CMMC Version 1.0 and its implementation timeline, there are still questions that remain unanswered. Contractors and subcontractors will need to remain proactive in acclimating themselves with the most current version of CMMC and preparing for the certification process once it becomes available. In the meantime, it would benefit contractors and subcontractors to be NIST SP 800-171 compliant during this time of transition. This may ease the transition to CMMC Version 1.0 compliance and could position themselves to attain a higher level CMMC certification as well as achieving a competitive advantage over others.
Burnette, R, Cassidy, S, Clark, S.L. Pentagon Updating Cybersecurity Guidance. Available at: https://www.nationaldefensemagazine.org/articles/2020/1/24/pentagon-updating-cybersecurity-guidance Accessed: (March 3, 2020)
Cassidy, S.B., Fein, A, Clark, S, Burnette, R, Rourick, D. DoD Announces the Release of CMMC Version 1.0. Available at: https://www.insidegovernmentcontracts.com/2020/02/dod-announces-the-release-of-cmmc-version-1-0/ Accessed: (March 3, 2020)
Itkin, S. CMMC V1: What it means for NIST 800-171 & the defense industrial base. Available at: https://www.exostar.com/blog/cmmc-v1-is-here-what-does-this-mean-for-nist-sp-800-171-and-members-of-the-defense-industrial-base/ Accessed: (March 3, 2020)
Guam Headquarters 414
West Soledad Avenue Suite 500
Hagatna, Guam 96910
US Headquarters 521
C Street Quantico, Virginia
22134
Copyright 2024 HazeGrayCyber | All Rights Reserved
