What’s next for CMMC

The Defense Department has revamped its cybersecurity standard for defense contractors and its implementation is on hold. But what does that mean for companies that expect to get government contracts before the final rule kicks in?

Matthew Travis, the CEO of the Cybersecurity Maturity Model Certification program’s accreditation body (CMMC-AB), told FCW that even with the reboot, there’s still work to be done and the goal is to get the interim and voluntary program up and running in early 2022.

“I think it's important to recognize that the real driver for this is scalability,” Travis said. He noted that under CMMC 1.0, there was a phase-in piloting period for contracts, starting with small and growing gradually.

“Instead of doing that, CMMC 2.0 says let's just not have the companies wait around for their pilot contract to have requirements,” he said.

Travis said the number of assessors and certified third party assessment organizations wouldn’t have been able to meet demand once the rulemaking was done, and the pivot with CMMC 2.0 builds in elasticity by allowing self-attestation.

“This is a scalability management mechanism that the department can dial up or dial down. And if there are a very limited number of C3PAOs and assessors, then they're going to have to probably have more level 2 contracts be designated for self-attestation. Then if you look down the road a couple of years from now, we've got a full complement or full capacity of C3PAOs and assessors well then there'll be less of a need to do that,” Travis said.

While the Defense Department still has to review it, the CMMC-AB is proposing to still offer level 1 certifications, as a voluntary option, to companies that want it as an extra layer of assurance from a C3PAO assessment, Travis said Nov. 30 during the body’s monthly town hall meeting.

Meanwhile the interim program is relying more on self-attestation.

Travis told FCW that CMMC-AB is preparing to be the support for defense companies so they can “self-attest with confidence” especially because the stakes are potentially higher now that DOD is requiring a senior company official to attest to CMMC compliance rather than an IT administrator.

That new requirement could mean the DOD has recourse to pursue companies that misrepresent their compliance through the False Claims Act or via whistleblower notifications. For Travis, those risks support the importance of outside compliance.

“If you're an executive who's got to do this every year, I'd consider going ahead and getting certified, bring in a C3PAO” Travis said. “And it gives you that insurance policy that someone outside your organization has certified that you meet the requirements. To me, that's the better option than self-attesting even if your contract may not require it, or even if during this interim period, technically you don't have to do anything.”

What should contractors do now?

But even with the revamp, there are still a lot of unknowns on the specifics of CMMC implementation until the final rule is released. So what should defense contractors be doing now?

Eric Noonan, the CEO of CyberSheath, told FCW that the key is to focus on what’s real -- and that's the NIST 800-171 standards.

“Spend your time and your resources on what's required today...so what's required today is DFARS clause 7012, NIST 800-171,” said Noonan, who was previously the chief information security officer for BAE Systems. CyberSheath is a registered provider organization with the CMMC-AB, which helps companies prepare for adopting the standard.

That means doing an assessment against the NIST standards, getting it scored, writing a system security plan to implement controls that are missing, and developing a plan of action and milestones (POAMs), which will eventually need to be resolved to get DOD contracts.

"It all starts with an assessment. And so a lot of this, well, it's complex, and it's hard to understand...it's actually pretty addressable,” Noonan said.

When asked how CMMC 2.0 could adapt to new or evolving threats, Noonan said while that’s a valid concern down the line, companies that want to do business with the Defense Department should focus on the basics first.

“So let's get multi-factor authentication enabled, let's do whole-disk encryption. Let's get the foundational stuff and then we can worry later about being more sophisticated,” Noonan said.