What DOD’s Cyber Certification Program Reveals About Info-Sharing Challenges

The Information Technology Industry Council is arguing that the foundation of U.S. cybersecurity policy—information sharing between organizations—presents a security threat that is too costly for many to address in response to a rule implementing the Pentagon’s Cybersecurity Maturity Model Certification Program.

The CMMC program was designed to change the Defense Department’s practice of having contractors simply attest to their own level of cybersecurity and institute a system of third-party auditors to validate required practices are in place. 

The department’s Defense Contract Management Agency currently conducts audits of contractors’ cybersecurity through Defense Industrial Base Cybersecurity Assessment Center, or DIBCAC, assessments. But Katie Arrington, the DOD official heading up the CMMC program, said a new ecosystem of private third-party assessors is necessary to scale such reviews across all of the approximately 300,000 companies the department relies on. 

Organizations hoping to work with the Defense Department would be required to obtain certification through an accreditation body that entered into a no-cost contract with the Defense Department on Nov. 25. The currently all-volunteer organization will be funded through fees it receives from assessors it trains to conduct audits and individuals it approves as qualified to consult with prospective contractors on CMMC requirements.

Organizations seeking certification would do so according to five tiers laid out in the DOD’s CMMC model, with levels four and five being necessary for organizations that require the highest level of security controls—because if their sensitive information were stolen it would be especially detrimental—and level one being the most basic cyber hygiene practices, such as using strong passwords and multifactor authentication.   

With an interim rule to implement the CMMC program taking effect Dec.1, Arrington in a recording for a TechNet event this week said that a press release from the department is imminent and will reveal the first 15 contractors to be audited under the new system in 2021.

The DOD has published 55 of 177 comments submitted in response to the interim rule. Arrington has said these will be considered before the department issues a final rule, which can be expected in January or February.

Among other things, ITI’s comments expressed concern regarding requirements at higher levels of the certification program and highlighted a broader challenge facing the government’s main approach to cybersecurity: information sharing. The Cybersecurity and Infrastructure Security Agency, for example, encourages organizations to share timely information about threats and adversary practices through sector-specific organizations called Information Sharing and Analysis Centers so their communities can collectively protect against them. But ITI’s comments suggest membership in such organizations is hardly commonplace. 

“An organization ‘may consider’ participating in multiple ISACs,” ITI said, describing one of the higher-level controls in the CMMC model. “However, [Advanced Persistent Threat] information sharing can oftentimes prove to be a security threat, and the cost to safely share this information is prohibitively expensive for many companies.”

ITI, which represents the largest and most prominent tech companies in the industry, declined to elaborate on its comments for Nextgov.

The costs for membership in an ISAC varies. For the automotive industry, it depends on an organization’s revenue and the financial services sector offers eight membership tiers, for example. There is a free way to securely share and receive information through the Department of Homeland Security, but participation by the private sector has been perennially lackluster. The industry has asked for additional liability protections to facilitate more information sharing with the government.  

But in the context of CMMC, ITI tied its comments regarding the costs of information sharing to a lack of confidence in dealing with the private independent third parties that would be conducting audits and expressed a preference for working directly with the government.  

“We suggest that DoD better outline Levels 4 and 5 in concert with industry and identify instances under which a contractor at these higher levels would be better off working with DoD to become certified in a classified environment,” ITI said, “instead of going through the [CMMC Third-Party Assessor Organization] process.”