Defense Information Network to Host Data Repository for Contractors’ Cybersecurity Audits, Official Says

Information about organizations seeking a stamp of approval under the Pentagon’s new Cybersecurity Maturity Model Certification program will be stored on the Department of Defense Information Network, according to the head of the accreditation body working with DOD on the CMMC. 

Currently, DOD contractors mostly pledge adherence to requisite cybersecurity practices. The CMMC, taking effect with a rule change expected this fall, will require all defense contractors to have their cybersecurity status audited and certified by an independent third party before they can do business with the department.  

The program has raised concerns among some contractors about cybersecurity for the apparatus being set up to manage the certifications and audit data, such as a repository DOD officials will use at the time of award to check whether prospective prime contractors and their associated subcontractors have achieved the necessary certification. 

“DOD intends to maintain their instance [of the repository] on the DOD network and we will be responsible for populating that,” said Ty Schieber, chairman of the board for the CMMC accreditation body.

Scheiber spoke during a press conference he and other accreditation-body board members held Tuesday following developments in their efforts to stand up an education and auditing ecosystem for issuing certifications to the DOD’s CMMC standard.

Though the formal education of assessors isn’t slated to start until late 2020 or early 2021, said Ben Tchoubineh, chairman of the accreditation body’s training committee, applicants are already paying to line up. 

“I’m pleased to report that we had a very successful ‘warm opening’ with over 167 transactions,” Schieber said.

According to a press release the accreditation body issued Monday, the application fee for an individual assessor to enter the program by first becoming a certified professional is $200. The application fee to become a certified third party accreditation organization (C3PAO), a group that houses the assessors, is $1,000.   

“When the formal educational program begins, either in late 2020 or early 2021, we’re going to start to educate people in earnest to become assessors,” Tchoubineh said. “So what we’re doing right now is selling vouchers for those exams ahead of time, so people can, you know, reserve their spot.”

New documents on the website of the CMMC accreditation body lay out requirements for applicants to serve in various roles. 

The C3PAOs, for example, will have to undergo their own certification process, which is to be determined by the accreditation body and will include some level of adherence to requirements issued by the International Organization for Standardization. 

“For C3PAOs, some of those requirements are still being discussed, but there are security requirements for all C3PAOs related to CMMC and related to ISO,” said Jeff Dalton, chair of the CMMC accreditation body’s credentialing committee. “So they will be required to adhere to a standard and a certification standard themselves to make sure they are protecting the data they are privileged to see when they conduct an assessment.”

The accreditation body also introduced a new role to the CMMC ecosystem: registered practitioners (RPs) and the registered provider organizations (RPOs) they can serve under. 

“The RPOs and the registered practitioners are an opportunity for those who want to be consultants or coaches in the field to not only get training and some qualifications in the CMMC but also be associated with ... our logo, but it also gives the AB an opportunity to understand who’s doing what out in the field,” Dalton said.

DOD and the CMMC accreditation body have been wary of conflicts of interest that could arise from those providing cybersecurity services also serving as assessors.

"One can never assess their own work!" Mark Berman, chair of the CMMC accreditation body’s communications committee told Nextgov. 

While movement within the rest of the CMMC ecosystem is pretty fluid—an individual could serve as both an educator and an assessor, for example—the role of the RPOs and RPs will be more limited.

“RPOs cannot be contracted to serve as assessors, nor can RPs be designated to perform assessments,” Berman said.

RELATED PODCAST