Reading time ( words)
Nolan Johnson discusses with Ryan Bonner of DEFCERT exactly where and how EMS companies should aim for CMMC certification. Organizations, he says, “need to avoid false dichotomies where they assume that either CMMC is a go or it’s not happening at all. All the government mandated reviews to keep CMMC moving forward, resulting in new contract clauses, are already underway. The rule making is scheduled; it will happen.
Nolan Johnson: Ryan, what’s the status of CMMC 2.0?
Ryan Bonner: The aspects of CMMC 2.0 that those contractors can act on now, even while we wait on other components, are the model itself and the assessment guide. Those are the two documents that are most appropriate for contractors. Because those two items are in place, there is a path forward for CMMC, even while secondary aspects of CMMC, like the C3PAOs assessment process or the eventual contract clauses that will drive adoption, are under the surface, if you will, and are going through rule making.
Johnson: There is something tangible that we can proceed with in anticipation of everything else coming into place.
Bonner: Absolutely. Many organizations don’t realize that the shift to CMMC 2.0 was the outcome of a review by the Government Accountability Office. I believe it was congressionally mandated as well under the National Defense Authorization Act. That process has already been completed.
The big change coming out of that review process was to shrink the model back to only the requirements described in the original parent document, NIST 800-171. That creates a situation where now the CMMC model under 2.0 is identical to the requirements and assessment content that’s in both NIST 800-171 and NIST 800-171A (the document used to assess 800-171). Those are identical. They’re in lockstep. There’s no appreciable difference between the two.
Johnson: If my company has already completed NIST 800-171, what does this mean regarding CMMC?
Bonner: You should be aware of two ways you might be assessed or graded against what you’ve already done. If you have already worked on 800-171, or even completed your implementation, you have two pathways. The first is being assessed by the government or the defense contract management agency that’s done through their DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) teams. But the DIBCAC teams, at no cost to you, schedule either a moderate confidence or high confidence assessment and, because of that, assign you a completion score using their assessment methodology. That’s one way to be assessed against NIST 800-171.
The other pathway is a proactive approach where you seek CMMC certification. This involves the accreditation body and their authorized assessing organizations, which are the C3PAOs coming in and, at your cost, you are assessed and then certified. That certification is expected to be good for three years. The difference there is that contracting officers are allowed to request your CMMC certification as a source selection criterion for awards. That’s the big shift. Organizations that want to skip many of the government audited steps can go straight to private sector certification, and then have that on file to show you’ve completed everything in NIST 800-171.
They’re not mutually exclusive, so if organizations haven’t completed NIST 800-171 implementations, there is an additional change to rule making that we expect next March. It will involve setting either certain minimum threshold scores or specifying which of the 800-171 requirements must be done as a prerequisite for contract awards while other, perhaps less vital implementations, can be saved until a 180-day window after-contract award.
Johnson: Sounds like there’s room there to transition without being completely locked out.
Bonner: Correct. Organizations should be aware of how compressed a 180-day window is for completing your implementations. It’s not a lot of time based on how long it seems to take most contractors to implement.
Continue reading the rest of this interview in the July 2022 issue of SMT007 Magazine.
