DOD Will Require Vendor Cybersecurity Certifications By This Time Next Year

The government has stringent processes for verifying the IT products and services it uses comply with relevant cybersecurity standards, such as authorities to operate for cloud services and supply chain regulations for hardware products. But those standards and processes don’t cover the vendors.

For the Defense Department, this is a critical issue, as doing business with industry requires the department to share sensitive information, even at the earliest steps of the process.

The department has been kicking around the idea of creating a certification standard for defense industrial base companies to ensure vendors’ cybersecurity posture was adequate to handle controlled and classified information. That became an official effort in March, and Wednesday the department released the first draft Cybersecurity Maturity Model Certification, or CMMC, outline for public comment.

At the top level, the framework covers 18 domains, described as “key sets of capabilities for cybersecurity” in a slide deck distributed by the Office of the Assistant Secretary of Defense for Acquisition. These domains include areas like access control, governance, incident response, risk assessment and the like.

Each domain is then assessed based on practices—the “activities performed at each level”—and processes—the level of maturity for each practice within the organization. By splitting this into two buckets, vendors can show that they have institutionalized the “processes,” even if they don’t get perfect marks on any given “practice” at the time of assessment.

Both practices and processes are assessed across five levels, from basic to advanced and optimized, respectively. The result is a five-tier system, each pegged to a certain level of cybersecurity assurance.

“For a given CMMC level, the associated practices and processes, when implemented, will reduce risk against a specific set of cyber threats,” the slide deck reads.

The tiered system is intended to make it easier for the department to streamline certification requirements, as well as to allow small businesses and others to tailor their efforts—read: costs—to their specific needs.

At the lowest level, practices include things like abiding by Federal Acquisition Regulation requirements and having basic antivirus installed on systems. At the highest tier—level five—practices are beefed up to include customized cybersecurity software, employing 24/7 security operations centers and automated incident response.

Once the maturity levels are established, the department plans to work with third-party assessment organizations to “conduct audits and inform risk,” similar in structure to the civilian Federal Risk and Authorization Management Program, or FedRAMP, which uses third-party contractors, dubbed 3PAOs, to verify the cybersecurity of cloud products.

The model is currently in its fourth draft, which the department released for public comment Wednesday. The department expects to be on the sixth draft by November and plans to issue the first release of the final version in January.

At this time, Defense officials expect the scope of the model to go down in size, rather than expand, as officials garner feedback, eliminate redundancies and down-select to the most important requirements.

The contracting community will have some additional time to absorb the final version—but not much. Defense offices will be expected to include certification requirements in requests for information by June 2020 and in solicitations by fall of next year.

Comments on the current draft are due by 5 p.m. Sept. 25. The department is looking for feedback on four questions:

• What do you recommend removing or de-prioritizing to simplify the model and why?
• Which elements provide high value to your organization?
• Which practices would you move or cross-reference between levels or domains?
• In preparation for the pending easy-to-use assessment guidance, what recommendations might you have to clarify practices and processes?