The Pentagon wants to move quickly with its review of the Cybersecurity Maturity Model Certification program, but plenty of questions swirl around what defense officials can do differently this time to balance compliance concerns for small businesses with the need to enforce cybersecurity requirements.<\/p>\n
The CMMC review team met for the first time on Thursday, July 16, Defense Department Chief Information Officer Kirsten Davies told reporters that same day following a tour of the factory floor at Kform, a small defense manufacturer based in Sterling, Va.<\/p>\n
Davies was joined on the tour by Small Business Administrator Kelly Loeffler and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey.<\/p>\n
Davies said small business considerations were central in the decision to suspend CMMC third-party assessment requirements<\/a> and launch a \u201ctop-to-bottom\u201d review of the program. The goal is to address cost and compliance concerns that Davies, Loeffler and Duffey said are creating barriers for smaller companies to compete for defense contracts.<\/p>\n ]]><\/p>\n \u201cWe took this action because data, including the reports from the Small Business Administration, makes one thing very clear: our planned compliance requirements progression was creating prohibitive costs and unacceptable burdens to the defense industrial base,\u201d Davies said.<\/p>\n DoD has published a request for information<\/a> on the CMMC review. And officials will also hold listening sessions across the country to get feedback from defense contractors, \u201cespecially the small businesses, and from the cybersecurity operators and executives who serve your companies,\u201d Davies said.<\/p>\n \u201cWe want to hear back from the defense industrial base, we want to hear back even from Cyber [Accreditation Body], from the assessors themselves, to hear what their ideas are for how to again increase and uplift cybersecurity and operational resiliency, but also improve the speed, the innovation, and the delivery of the capabilities to the warfighters,\u201d she said.<\/p>\n Davies said the review team has 60 days to gather feedback and review the program, then 15 days to provide a report with recommendations to herself and Duffey.<\/p>\n That timeline would see the CMMC review finalized by late September.<\/p>\n \u201cWe\u2019re hoping shortly thereafter that we\u2019ll be able to make that report public along with the recommendations,\u201d Davies said.<\/p>\n During the review, DoD has suspended CMMC third-party assessment requirements that were on track to become standard in many defense contracts starting Nov. 10.<\/p>\n ]]><\/p>\n Davies and other officials over the past week have been highly critical of CMMC\u2019s third-party assessment approach. She called CMMC assessments a \u201cburdensome, red-tape ridden, check-the-box, point-in-time view of a company\u2019s handling\u201d of sensitive data.<\/p>\n But Davies did not say whether the review would get rid of third-party assessments altogether.<\/p>\n \u201cIt could include everything from an overhaul to small tweaks here and there,\u201d she said. \u201cBut what we\u2019re not going to do is death by a thousand cuts and just change for the sake of change. We are going to listen to what the defense industrial base has to say, especially small and innovative companies. And we are going to incorporate the voice of small companies to make sure that we are truly reducing barriers to entry for them to do business with [DoD].\u201d<\/p>\n To support the ongoing suspension, Duffey issued a memo<\/a> directing program officers to remove any CMMC third-party certification requirements from active solicitations.<\/p>\n And if the department does decide to overhaul the program following the review, officials could use class deviations or interim rules to quickly change direction, according to Sandeep Kathuria, a partner at the law firm Saul Ewing.<\/p>\n \u201cWe have seen in many areas that this administration can move very quickly to make regulatory changes,\u201d Kathuria said.<\/p>\n D\u00e9j\u00e0 review<\/p>\n DoD first began developing the CMMC program in 2019, during the first Trump administration, to verify compliance with existing cybersecurity requirements. Inspector general audits and other reports had found defense contractors were falsely self-attesting to meeting the requirements.<\/p>\n \u201cThe rulemaking is largely based on the fact that the self attestations were not working, and proof of that were the significant cybersecurity incidents that the department has been a victim of through various nation state actors,\u201d Eric Crusius, partner and government contracts practice chair at Hunton Andrews Kurth, told Federal News Network.<\/p>\n The latest CMMC review comes five years after the Biden administration launched its own review of the program, which was also motivated in large part by small business compliance concerns.<\/a><\/p>\n ]]><\/p>\n The outcome of that review was to simplify the CMMC standards and reduce the number of companies that would require a third-party certification.<\/a> DoD officials called the revised program \u201cCMMC 2.0.\u201d<\/p>\n DoD finalized the CMMC 2.0 program rule in 2024 and the associated contracting rules<\/a> last year. DoD was phasing in the new requirements, starting with CMMC self assessments. But voluntary third-party assessments started picking up steam last year, while some DoD program offices have also elected to include the \u201clevel two\u201d CMMC third-party assessment requirements in their solicitations this year.<\/p>\n According to the Cyber AB,<\/a> \u201cnearly 2,000\u201d defense contractors have been certified at CMMC level two.<\/p>\n During the ongoing review, DoD is still enforcing the requirements for CMMC self-assessments. And DoD is not changing associated requirements for contractors to secure data in line with National Institute of Standards and Technology controls for protecting controlled unclassified information (CUI).<\/p>\n Davies also emphasized that DoD can still step in and evaluate a contractor\u2019s cyber compliance through its Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).<\/p>\n She also pointed to the cybersecurity services that are available to defense contractors through the National Security Agency\u2019s Cybersecurity Director, as well as services<\/a> provided by DoD\u2019s Cyber Crime Center<\/p>\n \u201cWe need to be thinking much more creatively, cleverly, and holistically at how we support vendors, contractors, and DIB companies who supply for us, who produce for us,\u201d Davies said.<\/p>\n But the services provided today by the NSA and DC3, respectively, only meet a small portion of the required NIST controls.<\/p>\n And DoD established the Cyber AB and its network of CMMC third-party assessment organizations (C3PAOs) because the department itself doesn\u2019t have the capacity to audit tens of thousands of defense contractors.<\/p>\n \u201cIf DoD concluded that it was in the DIB\u2019s best interest to rely more heavily on self-assessments than the original CMMC 2.0 had envisioned, it would be a notable return to the original system that the department said was insufficient, and that necessitated the creation of CMMC 1.0 under the first Trump administration,\u201d Kate Growley, a partner at the law firm Crowell & Moring, told Federal News Network.<\/p>\n In the absence of third-party assessments, DoD has relied on a limited number of reviews by DIBCAC and the Justice Department\u2019s expanding enforcement<\/a> of cyber standards using the False Claims Act (FCA).<\/p>\n As DoD forges ahead with the self-assessment requirement, Growley said contractors should be aware of the legal risks.<\/p>\n \u201cAny time where you are relying on your own assessment and representation instead of one of an accredited third party \u2014 which the DoD has stood up an entire ecosystem to create assurances around the evaluation and the reliability of that third party \u2014 that will create FCA risk for contractors who are misrepresenting what that score should be because they are relying on the self-assessment methodology,\u201d Growley said.<\/p>\n Costs, assessor capacity<\/p>\n Pentagon officials are pointing to CMMC compliance costs and assessor capacity as key barriers for small businesses. But those figures are likely to be debated as DoD\u2019s review unfolds.<\/p>\n For instance, Davies said the program is constrained by a \u201csevere shortage of third-party assessors.\u201d<\/p>\n But the Cyber AB, the nonprofit organization that has a DoD contract to oversee C3PAOs and other parts of the CMMC \u201cecosystem,\u201d has been working to build assessor capacity for years.<\/a><\/p>\n