This certification is intended to be a single standard for all DoD contracts in the very near future (2020-2021). The issue is that the current measures required by DAFRS 252.204-7012 do not seem to be preventing the loss of sensitive technical data. Companies self-attest that they are compliant but without inspections and certification by a third-party, the effectiveness of these programs cannot be measured and the result of these efforts is unknown. The loss of sensitive data creates a threat to our national security and places our armed forces at greater risk. The loss (the theft) of our scientific data, technology and TDP's helps our adversaries who use it to create advanced weapons systems and strengthen their overall military capabilities. In short, they know what we know. Their weapons systems can do what ours can do and they achieve this capability without expending the time, effort and resources to make these discoveries. It's a very real short-cut that is likely changing the balance of power on the battlefield.

 

At this time there is very little information available concerning what the CMMC will entail. Indications are that the certification will be just that a certification. Any defense contractor will be required to implement the program as required, undergo an inspection and achieve certification to be eligible for DoD contracts. Companies that fail to rigorously pursue and maintain their program will likely face more severe consequences if there is a cyber incident than a company that has an incident but has made every effort to create the strongest possible program.

 

It is also speculated, that because these new requirements are being specified that costs associated with these efforts will be allowable.

 

Over the past year there have been several articles/reports related to this topic. Many have identified DoD supply chain as a "weak link" the "soft underbelly." These type of articles seem to point in the direction that something has to be done. A change is needed. Two other indicators that changes will be occurring in the near future are first, this initiative is being led by Katie Arrington, Special Assistant to the Assistant Secretary of Defense for Acquisition. Ms. Arrington reports to Ellen Lord, Under Secretary of Defense for Acquisition and Sustainment. So this effort has significant visibility and attention. The second indicator, as reported this week in Inside Defense ( www.insidedefense.com) is that "House authorizers want more information from the Defense Department on efforts to secure the defense industrial base from cyber threats and protect technology critical to national security, as lawmakers are concerned the department is not synchronizing its activities." DoD will be required to submit a report by May 2020. Given that the roll-out of the CMMC is estimated to be sometime in 2020-2021, the roll-out may be tied to the May report and may be presented as a pro-active measure.

 

Naturally the business question is - will it be worth my time and effort to pursue certification under the CMMC? What will be my ROI? Every company needs to ask this question but first should develop their go / no-go criteria. One question, that needs to be answered is - in today's world market with a very dynamic cyber environment, can you afford not to develop and implement a robust and evolving cyber-security posture and systems. What do your commercial customers think/require? Something else to consider is what impact such a certification may have upon DoD's Industrial Base. Will it shrink or expand? As a result will there be more or less opportunities? Another article published by Inside Defense mentions that "The House Armed Services seapower and projection forces subcommittee is seeking information from the Navy about the industrial base's ability to achieve the service's current goal of a 355-ship fleet." While the growth of the fleet can be viewed as one measure of contracting opportunities for Defense Contractors, the 2020 defense policy bill that was adopted on June 4, 2019 "would mandate the Navy secretary present a report detailing how the service "plans to manage the need to grow the shipbuilding workforce as it builds to a 355-ship Navy." Needing to grow the workforce can also be viewed as a measure of future opportunity for interested, capable, prepared and responsible companies.