CMMC overhaul to change cybersecurity requirements for defense contractors

guest · Nov 5, 2021

Pentagon issues revised cyber standards for contractors
November 4, 2021
https://therecord.media/pentagon-issues-revised-cyber-standards-for-contractors/

The Defense Department on Thursday released a revamped framework and digital security standards for contractors that is intended to “minimize barriers” for compliance.

The updated Cybersecurity Maturity Model Certification, dubbed “CMMC 2.0,” is the result of a months-long internal review by the Pentagon after industry groups and contractors expressed concerns about the scope of the effort, which began to take shape in 2019, and that it could become another source of red tape in the already bureaucracy-heavy Pentagon.

“CMMC 2.0 will dramatically strengthen the cybersecurity of the defense industrial base,” Jesse Salazar, deputy assistant secretary of defense for industrial policy, said in a statement. “By establishing a more collaborative relationship with industry, these updates will support businesses in adopting the practices they need to thwart cyber threats while minimizing barriers to compliance with DoD requirements.”
Click to expand...

The original framework’s five-tier system is pared down to three under the new model. It also no longer requires every defense contractor to obtain a third-party certification if they don’t handle “controlled unclassified data” —a generalized classification for information which in this instance would predominantly mean DoD systems, including weapons.
Click to expand...

guest · Dec 21, 2021

DOD publishes CMMC 2.0 assessment guides
December 21, 2021

The Department of Defense published two detailed guides on how contractors will have their networks inspected to continue earning contracts once new regulations are added to contracting rules.

The Cybersecurity Maturity Model Certification assessment guide for level one and two requirements will cover the vast majority of contractors in DOD, with level one being a self-assessment and level two requiring some to get a third-party assessment, according to the documents. The assessment guides are new to “CMMC 2.0” which comes after changes were made by the department to pair down the contractor cybersecurity program.
Click to expand...

The self-assessment guide for level one of CMMC closely resembles a guide from the National Institute for Standards and Technology, Johann Dettweiler, director of operations at TalaTek, a certified assessment organization said.

“Honestly, it’s a waste of time and money. It’s NIST 800-171A. I am not sure why the Department of Defense felt the need to waste resources and effort on re-branding a framework that already exists,” Dettweiler he said.
The level two assessment guide is much deeper and more complex, as it contains more security controls and targeted at certified assessors that will need to verify contractor compliance.
Click to expand...

The goal is to ensure “maturity,” as CMMC’s name implies, of cyber practices and not just compliance. The DOD is currently working through the rule making process in order to be able to add the requirement to contracts in the coming years.
Click to expand...

Log in or Sign up

CMMC overhaul to change cybersecurity requirements for defense contractors

guest Guest

guest Guest

Log in or Sign up

CMMC overhaul to change cybersecurity requirements for defense contractors

guest Guest

guest Guest

Useful Searches