In a recent Agile IT Brown Bag session, Sean Spicer announced that Agile IT is now a CMMC Registered Provider Organization. This recognition comes after years of assisting organizations in meeting cybersecurity requirements, particularly NIST 800-171, and migrating to GCC High. This article delves into the Cybersecurity Maturity Model Certification (CMMC) and its implications for contractors in the defense sector.
Key Takeaways
CMMC is a new requirement for defense contractors to ensure cybersecurity compliance.
The rollout of CMMC will occur in phases, affecting thousands of contractors over the next few years.
Understanding the different levels of CMMC is crucial for compliance and contract eligibility.
The Evolution of Cybersecurity Regulations
The journey to CMMC began with the Federal Acquisition Regulations (FAR), established in 1979 to streamline government acquisitions. FAR includes mandatory clauses for federal contracts, including 15 safeguarding requirements for federal contract information. Each agency can create its own supplements, leading to the Defense Federal Acquisition Regulations Supplement (DFARS) for the Department of Defense (DoD).
On December 21, 2017, DFARS clause 252.204-7012 (referred to as DFARS 7012) came into effect, mandating compliance with NIST 800-171 to protect Controlled Unclassified Information (CUI). However, the lack of a certifying body meant that the government had to trust contractors to comply without verification.
The Need for CMMC
The absence of a certifying body led to significant compliance issues, with many contractors failing to maintain their System Security Plans (SSPs) and Plans of Action and Milestones (POAMs). This gap opened the door for lawsuits under the False Claims Act (FCA), which allows individuals to sue on behalf of the government. In 2019, the Department of Justice secured over $3 billion in FCA settlements, highlighting the need for a more robust compliance framework.
In response, the first draft of CMMC was released in 2019, with the official document published in January 2020. This new model introduced third-party assessments for cybersecurity compliance, marking a significant shift in how contractors must demonstrate their cybersecurity posture.
CMMC Rollout Timeline
The CMMC rollout will occur over several years, with a phased approach:
Fiscal Year 2021: 15 new contracts with CMMC language affecting approximately 1,500 contractors.
Fiscal Year 2022: 75 additional contracts impacting 7,500 contractors, including Level 4 and Level 5 requirements.
Fiscal Year 2023: 750 new prime contracts affecting 25,000 contractors.
Fiscal Year 2024: 1,479 prime contracts, adding over 47,000 certified contractors.
Fiscal Year 2025: Stabilization as the first contractors undergo reassessment.
Fiscal Year 2026: All DoD contracts will include CMMC requirements.
Understanding the Defense Supply Chain
The defense supply chain is complex, involving numerous contractors and subcontractors. For instance, the F-35 program has nearly 1,900 contractors across 45 states, producing everything from electronics to training manuals. This intricate web of contracts and information is known as the Defense Industrial Base (DIB).
Types of Information in the Defense Supply Chain
Federal Contract Information (FCI): Information not intended for public release, primarily related to the defense supply chain.
Controlled Unclassified Information (CUI): Information created by the government or on its behalf that requires safeguarding and dissemination controls.
CMMC Levels Explained
CMMC consists of five levels, each with specific practices and processes:
Level 1: Focuses on protecting FCI with 17 practices and no processes.
Level 2: A transitional level with 72 practices and the first two processes.
Level 3: The most common level, requiring 130 practices, including all 110 from NIST 800-171.
Levels 4 and 5: Reserved for the largest and most targeted primes, with only 144 companies expected to meet these levels.
The Role of GCC High
For contractors aiming to meet CMMC Level 3 and higher, particularly those handling CUI, GCC High is essential. While Levels 1 and 2 can be met using Microsoft Commercial, higher levels necessitate GCC High to ensure compliance with DFARS 7012 and 7021.
CMMC represents a significant shift in how cybersecurity compliance is approached within the defense sector. As the rollout progresses, understanding the requirements and preparing for assessments will be crucial for contractors. Agile IT is committed to supporting organizations through this transition, ensuring they meet the necessary standards for cybersecurity maturity.
In today's digital age, robust cybersecurity measures are more important than ever. At BetterWorld Technology, our team of cybersecurity experts is committed to safeguarding your business from evolving threats. We offer comprehensive solutions tailored to protect your data and infrastructure. Whether you need proactive monitoring, threat assessment, or incident response, BetterWorld Technology has the expertise to keep your business secure. Contact us today to learn how our cutting-edge cybersecurity services can fortify your defenses. Enhance your cybersecurity posture and ensure peace of mind with BetterWorld Technology.