Who's going to volunteer for the new CMMC?

The Defense Department is looking for volunteers to test out its revamped cybersecurity standard for contractors.

After several months of review, DOD officials laid out a new version of the Cybersecurity Maturity Model Certification program that will be used as part of a larger strategy to gird the defense contractor companies against cybersecurity threats.

Contractors are being asked to keep working on improving their cybersecurity posture as the Defense Department wades through the rulemaking process to make CMMC a contract requirement and finalize those details -- a process that could take up to 24 months. However, in the meantime, the department wants some volunteers to test out the changes.

Buddy Dees, the director of the CMMC program management office, said during this transitional phase the department wants some organizations to volunteer to be assessed at CMMC Level 2.

"Part of this transition period, the department is also exploring some opportunities where we can provide incentives to those in the DIB who want to volunteer to get a level two certification using the 2.0 framework. So we are currently starting to work on some opportunities in that area," Dees said during a virtual town hall event on Nov. 9 hosted by the CMMC Accreditation Body, which is charged with overseeing the implementation of the professionals and organizations needed to train and certify for CMMC.

Dees stressed that any CMMC assessments done before the completion of the final rule would be voluntary.

"All the assessments that will be done by the [CMMC Third-Party Assessment Organizations] will be on a strictly voluntary basis by the [defense industry base] company. They will have to request that the level two assessments be performed and to make that contact with the C3PAOs."

Back to basics with more flexibility

Defense officials and contracting experts have long said that changes to the details of the CMMC program were likely, and the latest strategic shift following a months-long review affirms that.

There are now three CMMC levels, down from five, with Level 1 being foundational for defense companies that hold federal contracting data that's not critical to national security. Those companies will be required to submit an annual self-attestation and affirmation from a senior company official noting compliance.

Level 2 is for companies with controlled unclassified information and aligns with the National Institute of Standards and Technology (NIST) SP 800-171 requirements, however some companies with a lower risk profile may only need a self-assessment rather than a third party assessment. Level 3 is reserved for the highest priority programs with CUI, such as mission critical programs and weapons systems. Defense companies that fall in that category will look to the NIST SP 800-172 requirements and be assessed by the Defense Department.

"During this period, again, the 110 requirements that are now associated with level two are the same 110 requirements that have been on the books for years now, under the DFARS 7012 clause. So now is a good time to take this opportunity to start working down on those 110 requirements so that when we do get the final rule in effect, you will be set for success," Dees said.

The new standard is also more forgiving and allows for waivers of some requirements and using plans of action and milestones, called POA&Ms. However, there are some stipulations.

Dees said companies would now be required to close out open POA&Ms within 180 days of a contract award. If not, then the contract officer could "implement the normal remedies for failure to meet contract requirements."

Moreover, there are some requirements that DOD won't allow to be deferred, while some acquisitions, particularly for mission critical capabilities, may be given a temporary waiver to CMMC. That waiver has a time limit and requires a written justification and approval by a senior defense official.

"There's a small subset of requirements that the department feels every company should have in place to protect CUI...those will be required to be in place and not part of a POA&M as you go forward toward a contract award," Dees said, noting that there will be a minimum threshold on what requirements can be on POA&M tied to contract award eligibility.

A single federal standard?

David McKeown, DOD's deputy CIO for cybersecurity, said during the virtual event that the first version of CMMC "attempted to enforce some cybersecurity practices on companies that maybe didn't need to have them because the data that they possessed really wasn't sensitive DOD data" and the 2.0 approach aims to zoom in on risk by, focusing on the particular programs and mission areas that require rigorous cybersecurity vetting.

Additionally, the new version should be more easily adaptable for the rest of the federal government, McKeown said, so that " if we partner with the rest of the federal government, they will find it easy to adopt as well without a lot of extra DOD stuff added in."

That is all of the CMMC unique practices and maturity processes that were previously required in the first version have been scrapped in favor of closely sticking with NIST requirements. And if new ones are needed, DOD will work with NIST to add them, McKeown said.