This white paper is excerpted from a panel discussion held on April 29, 2020, sponsored by the GovConnects Program at the Howard County Chamber of Commerce. Panelists: Shirley Collier, Scale2Market; Brian Hubbard, Edwards Performance Solutions; David Shafer, PilieroMazza PLLC; and Anna Wright, PilieroMazza PLLC.
Why CMMC?
Shirley: The aggregate loss of controlled unclassified information (CUI) from the Defense Industrial Base (DIB) increases risk to national economic security and in turn, national security. To reduce this risk, federal contractors are being required to enhance the protection of CUI, or this controlled unclassified information in their networks. The Council of Economic Advisers, an agency within the Executive Office of the President, estimates that malicious cyber activity cost the U.S. economy between $57 Billion and $109 Billion in 2016 alone. The Center for Strategic and International Studies (CSIS), in partnership with McAfee, reports that as much as $600 Billion, nearly 1% of global GDP, may be lost to cybercrime each year. The Department of Defense is serious about mitigating this significant threat and societal cost.
Let’s begin by understanding the history of cybersecurity awareness by the DoD.
Anna: DoD has been placing increasing emphasis on cybersecurity because of the financial costs, and of course because DoD does not want highly sensitive information to fall into the wrong hands.
Cybersecurity is now the “fourth pillar” of DoD acquisition, with some solicitations now adding specific cybersecurity requirements to their evaluation factors (in addition to the traditional focus on price, technical, and past performance).
Currently, the FAR and DFARS address cybersecurity via two main clauses:
- FAR 52.204-21, which prescribes basic cyber safeguards
- DFARS 252.204-7012, which prescribes more advanced cybersecurity requirements, including compliance with all the controls in NIST SP 800-171
Critically, the FAR and DFARS clauses only require self-certification, and there is no clear mechanism for verification that all the controls are being followed.
Shirley: Brian, what was the problem with the old DFARS? Why was CMMC necessary?
Brian: The current DFARS clause 252.204-7012 that Anna mentioned, was a good first attempt at raising the bar of Cybersecurity within the DIB. However, from the beginning, it lacked an enforcement mechanism. It was up to each individual Contracting Officer (CO) to determine the compliance of a contractor. Unfortunately, there was no mechanism to ensure that compliance gaps were ever filled, or to ensure that the self-assessment was at all accurate. In addition, there was no mechanism to ensure that the company’s claims of compliance were at all true. So, basically the DoD got no additional assurance that the DIB could adequately protect the data it wanted to have protected.
Enter CMMC. The CMMC model builds on the standards called for in the current DFARS rule, namely NIST Special Publication 800-171 Revision 1 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The certification process will require companies to be audited by a Certified 3rd Party Assessment Organization (C3PAO). These certifications will follow a set of standards that will ensure that the CMMC is interpreted the same way across the board. This will even the playing field in the competitive environment of the DIB. In addition, these certifications will be centrally managed by a CMMC Accreditation Body, giving the DoD a single authoritative source of verification that a contractor is compliant. All companies doing business with the DoD will be required to achieve a minimum of Level 1 certification. CO’s will only have the discretion of determining what level is required.
Shirley: And why do contractors need to tune into this now?
Brian: RFIs that include the requirement for certification will start rolling out this summer, in a set of “Pathfinder” programs. The DFARS rule change, requiring CMMC, is expected in the fall, and RFPs for these “Pathfinders” are expected in late fall or winter 2020 and into 2021.
- January 2020: CMMC v1.0 released
- June 2020: RFIs to include CMMC
- October 2020: DFARS rule change expected
- Fall 2020: RFPs to include CMMC
So why worry about this now? If you currently do business with the DoD, as a prime or as a sub, you should start preparing. If you wait until you see it in your RFP, contract or subcontract, you will be too late. The CMMC certification will be a “go-no-go” decision criteria on the award and the CO will not have a waiver option. In addition, there are over 300,000 defense contractors. All must be certified. So, the certifiers will be very busy. If you don’t pass an audit the first time, you may find yourself in a long queue to be reassessed, and you may lose out. In addition, large prime contractors are already starting to use the CMMC criteria as a gating function onto their teams. You will need to know where you stand.
It will take time and money to get ready for the certification audit, best to plan that in your budgets now.
Levels, Information Types, and Key Terms
Shirley: Can you give us a general overview of CMMC?
Dave: CMMC is comparable to CMMI in that it is a business system certification. There are five levels of certification, ranging from 1 (lowest) to 5 (highest). CMMC is designed to be a gatekeeper for doing business with DoD, so all companies in the “defense industrial base,” whether large or small, will need some level of CMMC certification to be eligible to continue supporting DoD. “Defense industrial base” includes subcontractors, and CMMC requirements will be flowed down to subcontractors—but, the fact that the prime’s work requires, for example, a Level 4 certification does not necessarily mean that all subcontractors performing pieces of that work will also need Level 4. To be clear: CMMC is required irrespective of the sensitivity of information on your systems and applies to information types beyond just CUI. Bottom line: if you work with DoD or in the DoD supply chain, the question is not if you will need CMMC, but what level you need and when you will need it.
Shirley: How do you know what level of CMMC you will need?
Dave: The level you need depends on the type of information you handle, and the requirement set forth in your government contract or subcontract. CMMC divides information into two big “buckets”:
- Federal Contract Information (“FCI”) is “information provided by or generated for the Government under contract not intended for public release”. This includes information contractors create in performance of federal contracts—basically, if it in some way relates to a contract, and it is not intended for public release, it is FCI.
- Controlled Unclassified Information (“CUI”) is “information that requires safeguarding or dissemination controls pursuant to and consistent with laws, regulations, and government-wide policies,” but is not classified. CUI generally includes things like personally identifying information, Government financial records, controlled technical information, etc. Contracting officers are supposed to mark information as CUI, but this does not always happen. The CUI Registry also contains guidance regarding what is and is not CUI.
Shirley: Can you explain the 5 levels and the domains?
Anna: Level 1 is where basic cyber hygiene is performed. This includes installing antivirus software, requiring usernames and passwords, escorting visitors, having locking doors, etc. This level corresponds to the requirements in FAR 52.204-21, which are already present in many federal contracts. Level 1 is appropriate if you have FCI only on your system, not CUI.
Level 2 is for intermediate, documented cyber hygiene where practices such as weekly system backups, a system security plan, locking accounts after unsuccessful logins, etc. are required. This level still is only appropriate if you have FCI, but not CUI.
Level 3 is defined as good cyber hygiene. It includes FIPS-validated encryption modules, separation of duties to involve cybersecurity-related conflicts of interest and keeping abreast of cyber threat intelligence. This level corresponds to DFARS 252.204-7012 and NIST SP 800-171, which means requirements analogous to Level 3 compliance are already included in many DoD prime contracts. Level 3 is the lowest level you will need if you handle CUI.
Levels 4-5 relate to proactive cyber hygiene. Procedures are reviewed and advanced cyber hygiene is optimized. These levels are not going to be applicable to most DoD contracts.
Shirley: And what are some of the key terms contractors should become familiar with?
Dave: There are 4: domains, capabilities, practices and processes. Domains define broad categories of cybersecurity controls. Capabilities are sub-categories of technical ability within each domain. Practices are specific activities that must be performed to support your cybersecurity capabilities. CMMC measures how well you adhere to the specific practices required to achieve your desired CMMC Level. And processes are the documentation, management, review, and optimization of cybersecurity activities you perform. Examples include company policies, handbooks, and procedures.
Shirley: Brian, what is the contractor community expecting in terms of what the minimum requirements will be?
Brian: The DoD has made it clear that all companies doing business with the DoD will need to be at minimum, Level 1 certified. If CUI is processed Level 3 is required. However, based on history, there is a lot of discussion out in industry about “requirements creep”. In other words, because COs and Prime contractors will want flexibility and may not know exactly when CUI will show up in the contract execution, industry fears that the de facto minimum will quickly become Level 3.
Shirley: Under which circumstances do you think levels 4-5 will be required?
Brian: Level 4 and 5 are expected to be reserved for very critical system development efforts. For example, the development of highly critical weapons systems. The DoD has stated that they expect the use of Level 4 and 5 to be a very small percentage of the overall contracts.
How CMMC Gets Into Contracts
Shirley: How will the new CMMC DFARS clause be issued and added to contracts?
Anna: The DFARS clause will need to go through the rulemaking process before it can be added to any contracts. CMMC administrators have stated that a rule is in the works, but it is still in the early stages so we do not yet know specifically when or how it will be implemented. There are currently no plans to add CMMC requirements to existing, awarded contracts. CMMC is meant to be added to new opportunities—so that means it can certainly be added to re-competes of existing contracts.
Brian: However, if the existing DFARS clause is included, it is expected to be enforced. The DoD is planning on the 5-year procurement cycle to get 100% of DoD contractors.
Shirley: Where in DoD RFP’s will CMMC be referenced?
Anna: Sections L&M of Requests for Proposals.
Shirley: So how do contractors obtain CMMC?
Anna: As Brian mentioned earlier, the CMMC Accreditation Body (“CMMC-AB”) will ultimately oversee CMMC certification. It has already been formed and is now in process of building the structure necessary to train CMMC Third-Party Assessment Organizations, or C3PAOs. CMMC-AB also plans to open a virtual marketplace where companies who need CMMC certification can view the 3PAOs. At this point, DoD has stated that CMMC certification will be good for three years.
Shirley: Anna, what is that web address? Or where can companies go now for additional information on 3PAO’s?
Anna: The web address for the CMMC-AB is cmmcab.org. The virtual marketplace is not online yet, but you can sign up for updates on the CMMC-AB website.
Brian: Some might assume that they can just pay for an audit and be done with costs. This is highly unlikely. You will need to plan for several costs. 1) there is the cost of understanding your gaps; 2) the cost of filling those gaps; 3) the cost of the audit; 4) there is likely to be a fee paid to the CMMC AB to actually get the certificate; 5) you must budget for running and maintaining your cybersecurity program at the appropriate level; 6) recertification every 3 years, and possibly annual audits.
Please note that the process of certification is not fully baked yet. No company is “Certified” or capable of certifying your company or your products. If someone tells you they are, they are lying to you!
Shirley: Although no one knows for sure, I have been telling my clients that the costs will be in the thousands not hundreds of dollars.
Anna: DoD has projected that the cost of a Level 1 certification—not upkeep costs, but just the certification—will be roughly $3,000. Certification costs will be allowable, and DoD has stated that contractors should build certification costs into their proposals.
How to Get Ready
Shirley: What can companies do to prepare?
Dave: Start preparing now! If you have FAR 52.204-21 and/or DFARS 252.204-7012 in any of your contracts, you should be at least partially ready now. Assess your systems and see where you need to improve. Be wary of scammers! There are no official 3PAOs right now. You cannot obtain CMMC certification yet. So, don’t fall victim to claims of early certification.
Understand that part of your CMMC evaluation will be an assessment of how your cybersecurity practices have been used historically so it is important to start generating evidence of compliance before the assessment.
Brian: I would recommend starting with a gap assessment. Get an understanding of what you will need to do to be ready for an audit. Budget for those projects and get started on remediation. Start operating now as if you already have this requirement in your contracts. You are likely to have to show the auditors that the program is running and is being effective in your organization.
Some companies may not be able to do this internally or may not have staff with the cycles to do what needs to be done. In this case, hire a CMMC consultant to help you get ready. Edwards has designed a CMMC Quick Look© assessment to help companies get started in the right direction, without having to spend a lot of money. This Quick Look© will provide you an understanding of your gaps, the projects you should undertake, and some consulting time to help you through it. The great part in these times, is that this can all be done remotely.
Shirley: What are the specific steps companies can take to get ready for at least Level I?
Dave: Similar to the Quick Look© assessment that Edwards provides, at PilieroMazza we also offer a Cybersecurity Compliance Check-Up for a low flat-fee in order to help businesses identify the legal requirements that may be in their contracts, both government and commercial, or that are generally applicable to their specific industry. We find that it is helpful to make sure that businesses have a full grasp on the precise requirements they are obligated to meet so that the technical gap analysis that Brian and his team work on will have the legal requirements to cross-reference. Further, review/update employee policies and training. Review/update your agreements, particularly for flow-down provisions. Consider potential for protests of solicitation terms. Talk to your insurance broker about cybersecurity insurance.
Anna: Seek out from prime contractors through SBA or DoD mentor-protégé programs. Take advantage of free resources. DoD is slated to provide free training regarding CMMC.
Shirley: What are those web addresses?
Anna: Defense Acquisition University’s landing page for CMMC issues is dau.edu. This page contains signup links to three free training webinars that will take place in May, June, and July. Information on the SBA Mentor-Protégé Program is available at sba.gov, and information on the DoD Mentor-Protégé Program is available at business.defense.gov. And, as we mentioned previously, you can sign up for news and other updates from CMMC-AB via cmmcab.org.
Brian: Again, please remember that the Auditors aka C3PAOs, may be scarce resources for some time. It will be important that you are ready to pass the audit the first time, to avoid delays that could cost your business.
Business Development Questions
Shirley: Let’s address some of the practical business development issues related to CMMC. Do contractors have to meet CMMC requirements at the time of the proposal submission or at time of award?
Anna: Currently it is at time of award but understand that as a subcontractor you may be more appealing to a Prime if you have your certification in hand at the time of proposal.
Shirley: Does CMMC apply to contractors’ products as well as their networks?
Dave: Currently, no. CMMC is a business system certification, so the point is to certify your own capabilities. The COTS products you use (e.g., Microsoft Word, generic antivirus software) are not being certified here. In other words, certification is less about what products you use, and more about how you use them.
Shirley: Will civilian agencies be adopting CMMC?
Brian: Contractors are bracing for that. There was talk of the existing DFARS clause being adopted into the FAR. We are expecting that if CMMC proves effective in the DoD, it will be adopted into the rest of the Federal Government and likely, in some form, by many states. We are expecting that FAR changes will come next 2 years if not sooner.
Shirley: What will be the responsibility of primes to ensure their subs are certified?
Brian: The DFARS clause will have to flow down to all subcontractors. Now it is possible that if the prime contract requires Level 3 compliance, a subcontract may only need to be at Level 1 as Anna mentioned earlier. It will be the responsibility of the Prime to negotiate this with the CO. In theory, it will be possible for the procurement to predefine what pieces of the contract need to be at what level. However, history has shown that this is difficult for the Government to do, because they are likely not specifying the solution to the point that they could. It will be up to the Prime to propose what makes sense for the contract.
Shirley: Many businesses operate in the cloud. How do they ensure those applications and data are CMMC compliant?
Brian: They will need to work with their cloud providers. It is the businesses’ responsibility to ensure that whatever systems they use and whoever may be managing those systems are also complying at the level they themselves are required to comply with. We have all read or heard the stories of Managed Service Providers (MSPs) being compromised and their customers data being stolen.
Conclusion
CMMC is here to stay. Savvy federal contractors of all sizes are encouraged to get ahead of the curve: prepare their organizations, obtain certifications and monitor for ongoing compliance. What has started at the DoD is expected to become a requirement for civilian agencies in the near future.
Disclaimer
This communication does not provide legal advice, nor does it create an attorney-client relationship with you or any other reader. If you require legal guidance in any specific situation, you should engage a qualified lawyer for that purpose. Prior results do not guarantee a similar outcome.
Attorney Advertising: It is possible that under the laws, rules, or regulations of certain jurisdictions, this may be construed as an advertisement or solicitation.
