Will defense contractors be ready for CMMC?

Defense contractors will face big changes and tight timelines over the next year as the Department of Defense rolls out its new Cybersecurity Maturity Model Certification framework, experts say.

The framework, which aims to certify a company's compliance with federal cybersecurity regulations around controlled unclassified information (CUI), was announced by DOD officials in June. It will be used to evaluate and rate contractors' ability to protect sensitive data on a 1-5 scale starting next year. 

The initial version of the framework is scheduled to go public in January 2020. By June 2020, its requirements will start appearing in requests for information, and will become a regular feature of defense procurement by September 2020. That means defense contractors will have less than eight months to implement changes for compliance with the Defense Federal Acquisition Regulation Supplement and National Institute of Standards and Technology guidance on protecting CUI. 

"Any timeline would seem ambitious. One that looks to have this in operation by 2020, it's going to be difficult," said Robert Metzger, a lawyer specializing in government contracts and commercial litigation and a consultant for MITRE focusing on supply chain security issues. "Naturally industry has a lot of questions about the mechanics.... Companies are understandably uncertain as to how these changes will affect what they're doing, how they will demonstrate eligibility for contracts and what the costs might be upon their operations."

High costs, confusing guidance and low return on investment have all been cited as reasons for compliance challenges among defense contractors. Traditionally, DOD has declined to cover the costs associated with implementing acquisition regulations related to cybersecurity for CUI, but that has slowly changed over the past 12 months as military contractors have faced unprecedented attacks from foreign-sponsored hackers.

Last year, then-Deputy Secretary of Defense Patrick Shanahan expressed reluctance of the part of DOD to help contractors cover added costs for cybersecurity, saying security should be a baseline expectation in contracts. However, at a Professional Services Council event earlier this month, Katie Arrington, special assistant to the assistant secretary of defense for acquisition, announced that the department would allow contractors to write off a portion of their cybersecurity spending for government contracts, including implementing NIST guidance.

Alan Chvotkin, executive vice president and counsel for the Professional Services Council, welcomed the shift, telling FCW that it would be contradictory for DOD to refuse to provide financial incentives around cybersecurity at the same time it has expressed a desire to expand the number businesses that make up the defense industrial base.

Allowing contractors to write off a portion of their cybersecurity compliance activity is "an acknowledgement by the department that cybersecurity is not free," he said.

"To be a smart businessman, let alone a contractor, you ought to undertake this [level of security], because our adversaries are stealing everything," Chvotkin said. "On the other hand, [DOD] is trying to entice nontraditional companies and small companies who otherwise … might not see the need to incur such significant costs to reach the level that is expected as a contractor or subcontractor."

Still, it's not clear how DOD's reimbursement policy will work, which contracts it would apply to or what percentage of a company's costs would be covered. DOD is using the summer to conduct "roadshow" outreach sessions, sending officials across the country to meet with contractors, explain the new maturity model and take feedback from industry on the best way to structure the framework.

James Goepel, CEO and general counsel for the cybersecurity consulting firm Fathom Cyber, told FCW he has serious doubts as to whether many defense contractors will be ready by September 2020. For most companies, the associated costs are less about assets and technology and more about human resources, training employees and allocating the personnel to map out and formalize internal IT policies. Still, the potential for an initial shock to the federal contracting system is real.

"I do think that it's going to hurt us in the short term from a product-availability perspective," said Goepel, who also teaches cybersecurity at Drexel University's Law and Business schools. "The government is going to miss out on stuff, and there are going to be companies that go out of business because of this. But in the end, I think that it may actually be a better thing for country, unfortunately."

Metzger doesn't go that far, but said he does believe one short-term effect of the framework could be that a certain percentage of companies end up exiting the federal contracting space. In particular, the impact might be hardest on small and medium-sized businesses -- both subcontractors and primes -- with fewer financial resources that have traditionally evaded the same level of scrutiny directed towards prime contractors. Still, Metzger said he expects most companies will shoot for a middle ground that balances cost with business opportunity.

"I think the short-term impact is that companies of all sizes are going to be looking at affordable, effective ways to improve their cybersecurity. Nobody knows exactly today what you will need to do to get a security rating score of [1-5]," Metzger said. "Very few companies are going to strive for a 5 … but very few are going to want to have only a 1. I'm thinking that many companies will be targeting their investments and actions to be sure that when the scoring method comes into place that they will get at least a 3."