The state of CMMC from an assessor perspective

The Defense Department has embarked on a strongly needed and wide-ranging initiative to manage its supply chain risk process with some 300,000+ defense industrial base (DIB) contractors under the Cybersecurity Maturity Model Certification program otherwise known as CMMC. This effort, started about 18 months ago, has slowly progressed the past 10 months. The initial understanding and development has been directed by the DOD The Office of the Under Secretary of Defense for Acquisition and Sustainment Program Management Office (PMO) office since its inception in 2019 and the official release on 31 January 2020 of the CMMC model.

I have been an assessor and auditor for a multitude of federal agencies, including the DOD, for the past 30+ years. I have audited, assessed and reviewed many agencies, commercial organizations and companies across the U.S. and all over the world.

Recent events in DOD as well as the current administration’s program review of the CMMC effort have slowed down the rollout and implementation of the program. However, the continuing of the program events is active with, now four CMMC third-party assessment organization having passed their most important milestone Defense Contract Management Agency Industrial Base Cybersecurity Assessment Center Level 3 review in the past several months.

This status puts the assessment availability at four approved CMMC Third Party Assessment Organizations  with 183 more awaiting review and assessment -- not a great number of options for the various defense contractors wanting to receive their CMMC assessment, but it is definitely a start to the certification process. Now with four approved C3PAOs along with approximately 150 CMMC provisional assessors, 547 registered provider organizations and 1,960 registered practitioners available for initial efforts to advise and consult with DIB companies, the CMMC Accreditation Body ecosystem is well positioned to start the effort to get contractors ready for assessments. The DOD Program Review is the next milestone with any updates and/or changes to be instituted as follow-on action steps for the CMMC PMO or CMMC-AB.

These program reviews do periodically occur and provide a level set for the organizations and personnel involved in them. They do take time, so from the outside, they appear to delay the program but provide great guidance and feedback to the program participants.

In my opinion, however, the biggest changes coming to CMMC are related to the model and its implementation requirements for the DIB contractors. The current version, 1.02, came out in March 2020 and has not been updated or revised since then. In the cybersecurity world, 18 months is forever, and the state of security today is different than at that time, and the practices need review and updating. Think SolarWinds, Exchange, ransomware attacks, etc. For example, the data-in-transit tool of choice, Transport Layer Security (TLS) versions 1.0 and 1.1 were recently completely turned off by the Internet Engineering Task Force for the entire internet ecosystem, and this needs to be reflected in the model. Also, the National Institute of Standards and Technology has introduced SP 800-53 revision 5 and SP 800-172 documents, both of which are source documents for the CMMC model, and these need reflection into the model and its practices.

Now, slow but steady implementation guidance coming out from the CMMC PMO has contributed to contractor frustration and has led to widespread speculation on the program, its status and efforts. I see this with some frustration, as well, for as an assessor, I need the final views of each of the CMMC requirements so I can properly assess and advise our customers. But I also understand that CMMC PMO wants to produce the requirements for scoping an assessment, reviewing an organization’s status relative to the CMMC Model and identifying potential issues with the contractor’s security -- all important considerations in the lifecycle of the contractor’s support for DOD products and services contract deliverables. So, the PMO is methodically developing these components, slower than most would like, but nonetheless in a deliberate manner.

I have identified some areas of concern and some areas of practice that are relevant to DIB contractors seeking CMMC certification.

1. When the model or assessment guide identifies a type of technology or implementation requirement, this usually means DOD has previous experience with this area and has included lessons learned concerning this topic. (See TLS discussion above). DOD does not usually allow exceptions for these areas due to those “experiences.”
2. CMMC, by its very nature, is based on a history of cybersecurity implementation within and around the organization and the business it conducts in support of DOD. This requires these organizations and contractors to have put in and maintained the essential components of cyber hygiene that is referred to in the CMMC model for a period of time. How long is up to both the organization and the view of CMMC assessors when they review and conduct the assessment.
3. The organizations seeking CMMC certification are experiencing a wide range of business changes in today’s operating environments that leads to decisions made for each of them concerning security and operations. Those organizations must understand the stance taken by the DOD with respect to supply chain risk, which CMMC is designed to address.

• Supply chain risk has already been realized through a series of events results of data being stolen over the past five to 10 years.
• The pre-existing system for monitoring these risks was not working effectively.
• The adversarial nature of the supply chain attacks is increasing every day.

Overall, the CMMC program is a step forward for DOD and its contractors to improve the nature and the operation of the DOD supply chain in today’s cybersecurity-focused world. Whatever form the CMMC takes, keeping America safe and secure is the bottom line.