Failure to Launch: Why CMMC requirements will trip up the defense industrial base

The hackers behind last year’s infamous SolarWinds cyberattack are looking for their next big score. Showing no signs of stopping, the attackers are hoping to hit government agencies again and expose sensitive information. The IT supply chain is at risk and even the new CMMC requirements will be challenged to stop it.

Contractors and suppliers failed the last time when a software update containing malicious code was pushed out to SolarWinds’ clients, many of which were government agencies. It was another chink in the armor of the government supply chain, which let’s face it has been targeted for years. To combat it, the Department of Defense has required suppliers to implement standards to protect them, such as NIST-800-171. But there isn’t a system of checks and balances to ensure that suppliers are meeting the requirements, and many let them lapse.

To push maintaining better cyber hygiene message, the DoD has mandated CMMC, the Cybersecurity Maturity Model Certification, which dictates companies must implement proactive cybersecurity. The objective is to stop data leakage by forcing suppliers and contractors who do business with the government to maintain security standards that are audited and verified. CMMC applies to thousands of companies of all sizes.

But the road to compliance is bumpy. And organizations are bound to fail to meet the standards, which can cost them their business and put clients, partners, and suppliers at risk. While the newest update to CMMC makes companies that don’t touch controlled unclassified information exempt from a third-party audit, those who handle CUI will need to evidence and prove that they are keeping their systems up to par to meet the required standards.

But most will likely struggle. Here’s three reasons why:

1. Network complexity. Most companies are unsure what parts of their network are subject to CMMC. Part of a network could be subject to a different CMMC level from another. Some parts of a network could fall into scope for CMMC that a supplier isn’t even aware of, particularly if they receive sensitive information from a prime or subcontractor. That’s because CMMC rules follow the data.

2. Evidence. If you handle controlled unclassified information, you must demonstrate to assessors that it was handled appropriately and accurately. And you have to do it quickly. Most will struggle because they won’t have the tools to provide the required evidence.

3. The reality of compliance. There is a gap between where contractors think they are compliant and where they actually Most have a significant amount of work to do to be ready for CMMC. In fact, most are not even fully compliant with NIST 800-171, and, since suppliers previously only had to self-report, they may not be aware of this or the extent to which it’s the case. Many are going to get a dose of reality when they see the gaps that exist between actual and expected compliance, and they may be shocked to learn the time, resource and cost required to close these gaps.

Whilst these challenges aren’t insignificant, the defense industrial base cannot become complacent while CMMC v2 is fully implemented and rolled out – the bad actors targeting the defense supply chain sure aren’t easing off. So, it’s imperative that the contractors continue to adopt and effectively implement adequate cyber security to protect information and data in their networks.

There are three ways companies can start to make headway:

1. Look at previous guidelines. CMMC levels 1-3 aren’t fully defined yet, and while these new changes are still going through the rulemaking process, it’s a good idea for contractors, who will be subject to Level 1 requirements, to look at previous versions of the rules and start outlining expectations.

2. Ensure NIST 800-171 compliance. For any supplier that needs to meet levels 2 and 3, a good place to start is being compliant with NIST 800-171. The new Level 2 will consist of 110 practices that reflect the NIST 800-171 requirements, and if your organization needs to be Level 3 compatible this will also serve as a baseline towards meeting those additional security practices.

3. Consider seeking voluntarily certification. The phase in period may be long and CMMC compliance might sneak up on suppliers. Plus, the DoD has stated that they are exploring opportunities to voluntarily obtain certification in the interim. Getting started now is sure to reap benefits later.

CMMC’s goal is to protect agencies and partners, but right now we’re in a holding pattern until the program fully rolls out and changes are updated. But that doesn’t mean organizations should ignore its importance. Suppliers need guidance on how to meet and accurately evidence the criteria. Without that, the security gaps will only widen.