How companies should prep for CMMC

The Defense Department has been steadily working on its new unified standard, the Cybersecurity Maturity Model Certification (CMMC), and is expected to release a final version and a list of accrediting bodies in January. But while companies shouldn't wait until things are finalized to prep for certification, many are stuck.

"CMMC is going to be law of the land," Corbin Evans, the director of regulatory policy for the National Defense Industrial Association, told FCW, yet "folks are a little hesitant to make any major moves."

Evans said a proposed rule to amend the Defense Federal Acquisition Regulation is expected this summer to solidify language and regulatory authority to include CMMC to contracts and that it's possible "they may try and stretch and amend the FAR itself."

He added that many of NDIA's 1,600 corporate members haven't determined where they fall in CMMC or what level they will seek. 

One of the most prominent concerns at this early stage is the reliability of auditors. Like with any certification, it's important that CMMC have metrics that are consistent across the board.

DOD recently announced that Ty Schieber, the senior director for executive education at the University of Virginia’s Darden School Foundation, will head a 13-member governing body for the organization charged with certifying auditors.

A DOD spokesman told FCW that CMMC requirements will begin showing up in presolicitation documents around June 2020, and in the corresponding requests for proposals in September.

Eric Crusius, partner at Holland & Knight who focuses on government contracting, said CMMC could discourage businesses "that don't want to get into a new certification requirement" -- especially those with emerging technologies. He's also worried that the DOD could use the requirements to "artificially limit competition," he said during a Jan. 7 webinar on CMMC hosted by NeoSystems.

"If their favorite contractor has a level four, even if it's level three work, maybe [DOD will] set the RFP at a level four to kind of get those other contractors out of the way," Crusius said.

Higher certification levels could also be seen as a way for DOD officials to protect themselves, he speculated.

"DOD officials, agencies may be just as worried and want to have the best of the best as far as cybersecurity compliance goes," Crusius said, and "artificially make [a proposal] a level four when it's really only called for a level two, not necessarily because they want to limit competition but just want to protect themselves."

What to expect

"What's different here is that it's not a self-certification anymore; it's a third-party validation," Alan Chvotkin, executive vice president and counsel of the Professional Services Council, told FCW said.

Cyber assessments from different auditors that are unequal to one another is a worry for Chvotkin because it could affect whether the accrediting body and each certifier is respected and reliable. Almost like getting an appraisal, the ideal is that there would be little to no variation regardless of who certified it. 

"It's not from a company standpoint, it's what metrics, training, processes assessors will use. How do you validate?" Chvotkin said.

The establishment of the accreditation body as well as the release of the final version of CMMC are expected in January. But companies shouldn't wait, he said.

"Companies should already have some level of compliance," Chvotikin said. Companies with government contracts should start preparing now, he suggested, using the latest CMMC draft as a guide.

"I'd be very surprised if 1.0 is substantially different than 0.7," Chvotkin said. "If I had a single message, [it's]: Don't wait until the final is done and all the Is are dotted and Ts are crossed to get started."

Another reason to prepare early is that CMMC will likely be adopted by federal civilian agencies in the future.

"While the civilian agencies have not glommed on to CMMC, if it's successful, they're not going to be far behind," Chvotkin said. "They're looking at ways of doing something similar," as many have already adopted the NIST standard.

Johann Dettweiler, director of operations at Talatek, a certified auditor for the Federal Risk and Authorization Management Program, said on the NeoSystems webinar that writing things down is the first step.

"Even if you're trying to achieve level one, there's nothing wrong with getting stuff down on paper, starting to develop practices, policies, procedures, and, and getting those out to all your personnel so they're aware of them," he said.

But while preparing for CMMC might seem daunting, Dettweiler said it's okay to be imperfect.

"You don't have to be perfect, but just basically give it the best shot and then help and rely on the auditors to help you out further," Dettweiler said. "If you have failings, you're not meeting some of the requirements, that doesn't necessarily mean that you're not going to achieve the certification level you're after. There's always a process."

Right now, there's no requirements for certified auditors, which could delay implementation, Dettweiler said.

"The accreditation body hasn't been selected yet, which means there's no requirements for certified auditors," he said. "If they're already looking as early as June to start issuing certification levels for the RFI, that's maybe a little bit -- probably not true in their actual timeline."

"However, that doesn't mean that you shouldn't get started on this. All the information you have out there is there to get started on working on this."