Introduction
The Department of Defense’s (DoD) final rule on the Cybersecurity Maturity Model Certification (CMMC) program marks a pivotal shift for the defense industry. The program establishes a framework to ensure that contractors implement effective cybersecurity measures to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). An upcoming amendment to the Defense Federal Acquisition Regulation Supplement (DFARS) will give contracting officers the ability to mandate CMMC certifications in specific contracts. Once the DoD finalizes these acquisition rules, CMMC requirements will begin to appear in defense contracts.
In this article, we’ll explore the history of CMMC, its implications for the defense sector, and the proactive steps Component Products Corporation (CPC) is taking to stay compliant.
A Brief History of CMMC
The origins of CMMC trace back to Executive Order (E.O.) 13556, issued in November 2010. This order aimed to establish a consistent approach to managing sensitive information that, while not classified, required safeguarding and controlled dissemination, known as Controlled Unclassified Information (CUI). The National Archives and Records Administration (NARA) was tasked with implementing this CUI program across federal agencies. Although the executive order did not directly apply to government contractors, it laid the groundwork for extending safeguarding and dissemination controls to federal contractors.
To protect CUI within non-federal information systems, NARA, the National Institute of Standards and Technology (NIST), and the DoD collaborated to develop the NIST Special Publication 800-171 (NIST SP 800-171) standard. Subsequently, the DoD introduced amendments to the Defense Federal Acquisition Regulation Supplement (DFARS) requiring defense contractors handling controlled defense information to implement NIST SP 800-171 and self-attest to their compliance.
However, over time, it became evident that the self-attestation model was not sufficient to achieve the desired level of cybersecurity maturity within the DIB. Companies were not properly assessing and reporting their their cybersecurity compliance. In many cases companies did not understand the importance of an in-depth cybersecurity assessment or lacked the expertise to do so. In more extreme cases reported scores were a deliberate misrepresentation of the company’s cybersecurity posture. These issues were compounded by a growing number of cyber threats and exfiltration of sensitive information to foreign adversaries. In response, the DoD first introduced CMMC in 2019 as a replacement for the self-attestation model. After nearly five years of development, the CMMC final rule has been published, marking a significant shift in defense contracting within the Defense Industrial Base (DIB).
The Impact of CMMC
The CMMC program establishes a framework for verifying that contractors have implemented adequate security measures to safeguard FCI and CUI. To comply, many contractors within the DIB must undergo an assessment conducted by a CMMC Third-Party Assessment Organization (C3PAO). Contractors who fail to comply will be ineligible for contract awards requiring certification, posing a significant risk to the defense industry’s supply chain.
While the full impact of the CMMC program remains to be seen, concerns over the DIB’s preparedness are widespread. One study on DIB readiness found that only 4% of the DIB is currently prepared for a CMMC assessment. Additionally, another study found that 56% of DIB organizations report needing one to two more years to achieve CMMC Level 2 compliance. These findings underscore the limitations of the self-attestation model and the urgent need for third party verification of compliance. The widespread lack of readiness, coupled with the critical need for improved cybersecurity within the DIB, presents a major challenge. Contractors who are proactively investing in compliance are positioning themselves to be a part of the much-needed solution.
How CPC Is Preparing for CMMC
At Component Products Corporation (CPC), we have been proactively preparing for the Cybersecurity Maturity Model Certification (CMMC) since its announcement in 2020. Over the years, we have made substantial investments in technology, processes, and systems to achieve compliance with NIST SP 800-171. We are also scheduled for a CMMC Level 2 assessment to further solidify our commitment to cybersecurity. Meeting and exceeding customer requirements remains a core value of our business, and cybersecurity compliance is no exception.
Conclusion
The Cybersecurity Maturity Model Certification (CMMC) has the potential to significantly impact the Defense Industrial Base (DIB). Studies indicate that a substantial portion of the DIB remains unprepared for these new requirements, which could create considerable supply chain challenges for government agencies and prime contractors. At Component Products Corporation (CPC), we are committed to achieving and maintaining compliance to support our customers and strengthen the defense supply chain. If we can help your organization navigate these changes, please reach out to us.