The Department of Defense’s (DOD) Cybersecurity Maturity Model Certification (CMMC) has been a hot topic in the federal contracting world since its inception in 2019. Initially introduced as a unified standard for assessing and improving the cybersecurity of DOD contractors, the CMMC has undergone significant revisions in recent years. As the DOD continues to refine its cybersecurity standards, smaller federal contractors must navigate these updates to ensure compliance and remain competitive in the market.
Sources: Defense Innovation Unit, Lockheed Martin, MITRE, and the DOD’s website
New Rules of the Road
The latest updates to the CMMC, released in January 2022, have a significant impact on the way federal contractors approach cybersecurity. Gone are the days of a one-size-fits-all approach; the new model recognizes the varying needs of contractors and provides a more tailored framework for assessing and improving cybersecurity maturity.
The revised CMMC model consists of five levels of maturity, ranging from level one (basic hygiene) to level five (advanced). Each level builds upon the previous one, with contractors expected to demonstrate increasingly sophisticated cybersecurity practices and controls. The updated model also introduces a new framework for assessing and validating the maturity level of contractors.
What’s Changed?
So, what are the key changes that contractors need to be aware of? Here are a few key updates that impact the federal contracting community:
- New Level 1: Basic Cybersecurity Hygiene – The revised model introduces a new level one, which focuses on basic cybersecurity hygiene practices such as password management, network segmentation, and incident response planning.
- Level 2: Security Controls – Level two contractors will need to demonstrate the implementation of security controls such as access controls, auditing, and configuration management.
- Level 3: Risk Management – Level three contractors will need to demonstrate a more robust risk management framework, including threat and vulnerability management, incident response, and security awareness training.
- Level 4: Governance and Technology – Level four contractors will need to demonstrate a high level of maturity in governance and technology, including enterprise risk management, security governance, and advanced technology practices.
- Level 5: Advanced – Level five contractors will need to demonstrate the highest level of maturity, including advanced technology practices, artificial intelligence, and machine learning.
Impact on Small-to-Midsize Contractors
The updated CMMC model poses significant challenges for smaller federal contractors, who may struggle to meet the new standards. However, this is not necessarily a bad thing. In fact, the revisions offer opportunities for growth and improved security for contractors who are willing to invest in their cybersecurity capabilities.
A recent survey by the Defense Innovation Unit (DIU) found that 75% of federal contractors believe that the CMMC will improve their cybersecurity posture. Additionally, 60% of contractors reported a positive impact on their bottom line as a result of investing in cybersecurity.
