On September 29, 2020, the US DoD released an interim rule to amend the DFARS to implement a DoD Assessment Methodology and Cybersecurity Maturity Model Certification (CMMC) framework to assess contractor’s implementation of cybersecurity requirements for public comments. While cybersecurity requirements have been a part of the defense procurement process in the form of NIST 800-171 compliance for some time now, according to the release,
“findings from DoD Inspector General report indicate that DoD contractors did not consistently implement mandated system security requirements for safeguarding CUI,”
the current compliance requirement “does not provide the DoD with sufficient insights with respect to the cybersecurity posture of Defense Industrial Base (DIB) companies throughout the multi-tier supply chain for any given program or technology development effort,” and
the “NIST SP 800-171 per DFARS clause 252.204-7012, does not sufficiently address additional threats to include Advanced Persistent Threats (APTs),” and hence, the Department needs “a risk-based cybersecurity framework for the DIB sector, such as CMMC, as the basis for a mandatory DoD standard."
Outcome:
While the DoD’s goal is to ultimately have all contracts comply to CMMC, the phased roll-out process, effectively starting in about 90-days, includes a two-pronged approach in the interim to ensure DIB’s ability to protect FCI and CUI (Controlled Unclassified Information). The timeline to implement CMMC across the DoD contractor population will be approximately 7 years. The interim two-pronged approach includes:
1. CMMC:
The contracts mandating CMMC compliance will require a contractor to have the certification in place at the time of award. Therefore, the contractors who have seen CMMC requirements in RFI/RFP should start gap assessment process against the CMMC requirements now, remediate the gaps, and demonstrate process maturity to gain certification. They should also ensure that their supply-chain is also compliant. The requirements for CMMC are covered in our previous article.
2. NIST SP 800 – 171 DoD Assessment Methodology:
The contracts not requiring CMMC will require contractors to comply to one of the NIST SP 800-171 DoD Assessment levels (Basic, Medium, High) based on the criticality of the information. These contractors will be required to upload their assessment scores, dates of assessments, descriptions of required remediation actions and expected dates of completion along with their respective CAGE numbers onto the Supplier Risk Management System (SPRS). While contractors requiring Basic level assessments can perform the assessments themselves and upload the required information onto the SPRS, others will have to support government-performed assessments with evidence and documentations.
In essence, the DoD is enforcing rigor on cybersecurity risk management efforts within the DIB. Except for the organizations requiring Basic level of assessment, all others will have some degree of an external audit. It is in the best interest of all organizations to ensure information integrity, rigor, consistency and cost productivity in their cybersecurity risk management efforts. They should start their efforts towards CMMC as early as possible; it will not only make the transition to CMMC smoother but also improve their enterprise risk management in a cost-effective manner.
We, at ResiliAnt, continue to hold no-obligation webinars on this topic. We offer an easy-to-use platform that organizations can use to ensure compliance with CMMC as well as NIST SP 800-171 DoD Assessment, and manage their cybersecurity related risks in a cost-effective manner. To attend our webinars or learn more about our platform, email us at info@ResiliAnt.co.