CEO, Defense Cybersecurity Group (DCG), CMMC Lead Assessor, FBI Infragard SME on Cyberwarfare and Deputy Sector Lead, Defense Industrial Base
An interesting summary from Holland and Knight on the new #CMMC rule 32CFR170 which went final last Friday. I found their final paragraph particularly interesting... "The above is just the tip of the iceberg when thinking about the intricacies of the CMMC program and the implications for the DIB (including contractors far down the supply chain). Companies in the DOD supply chain would be wise to not delay further and ensure they are properly certified." At 470 pages the assessment community (C3PAO's and CCA's) are still getting their minds wrapped around the many aspects including significant changes that will impact how we assess Organizations Seeking Assessment (OSAs). The fundamental point though that DIB companies "would be wise to not delay further" is of course spot on. As Jacob Horne, Robert Metzger and others have been saying for a while, the time is past to get moving on having a cybersecurity program that supports CMMC compliance. There is a LOT of detail and nuance in a document with a word count 80% the New Testament. That said the fundamentals remain. First have a Program. This is not going to be something solved by either writing policies in a long weekend nor by buying a single tool. The #1 aspect of this or any program are the people executing it. These are activities that will need to be done now and into the future as long as an organization has a DoD contract or subcontract. The first thing to do for any program is pick the leader. Who will do this? Who will direct the work and make sure it stays on track? Do it in house, hire contractors, buy tools, whatever needs to be done... Who is the leader of your CMMC Program?
Eric Crusius
5mo
Vincent, appreciate the read and your insightful comments. Even for a Level 1 self-assessment, I always say that it is not a weekend project. Each control has to be scrutinized and validated consistent with the Assessment Guide issued by DoD.
Leader - Stacey B?
Anthony Awtrey
5mo
Small businesses, such as local construction companies and janitorial services, must meet CMMC to be eligible to bid for work. I've been helping some smaller clients in this category self-assess. How will a home-based business, like many small service companies, meet CMMC Level 1? They can only meet the physical security requirements if their home office is locked, which isn't realistic with extended families living at home. A very modest Microsoft Azure virtual enclave costs $10K or more per year just to bid work. Even when running virtually, your home network is still in scope for assessment. Under the final rule, companies who previously self-assessed to check the box are now threatened with the possibility of a False Claims Act charge. I'm curious how this plays out, but I worry we will lose small business competitive bids, and the taxpayer will indirectly fund the real cost of certification for larger small businesses.
Nicholas G. Erb
5mo
Very helpful and insightful Vincent!
Mike Parsons
5mo
Great advice. These takeaways by the team at Holland and Knight shine a spotlight on some of the issues that the cybersecurity, risk and compliance SMEs need to focus on from the beginning. But they are not the sum of concerns by any means.
Tony Buenger
5mo
Insightful
Legal Advisor in Government Contracts, Cybersecurity @ Ice Miller LLP with Defense Tech expertise
5moVincent Scott, with respect to your question, for any organization with a significant amount of business with the Department of Defense, the cybersecurity leader should be the CEO, with a CISO directly or functionally reporting to the CEO and driving implementation of the cyber program.