Are Contractors Ready for DOD’s Cybersecurity Framework?

Are Contractors Ready for DOD’s Cybersecurity Framework?

The cybersecurity maturity model certification could have a profound impact on the procurement landscape when it goes live next year

Contractors will face big changes and tight timelines next year when the Defense Department institutes its new Cyber Maturity Model Certification framework. Announced by DOD officials in June, the framework seeks to certify companies’ compliance with federal cybersecurity regulations for controlled unclassified information (CUI). It will be used to evaluate and rate contractors’ ability to protect sensitive data on a scale of 1 to 5.

The initial version of the framework is scheduled to go public in January 2020. By June, its requirements will start appearing in requests for information, and it will become a regular feature of defense procurement by September. That means defense contractors will have less than eight months to implement the necessary changes to ensure that they comply with the Defense Federal Acquisition Regulation Supplement’s and the National Institute of Standards and Technology’s guidance on protecting CUI.

“Any timeline would seem ambitious. One that looks to have this in operation by 2020 [is] going to be difficult,” said Robert Metzger, a lawyer specializing in government contracts and commercial litigation and a consultant who focuses on supply chain security issues. “Naturally, industry has a lot of questions about the mechanics… Companies are understandably uncertain as to how these changes will affect what they’re doing, how they will demonstrate eligibility for contracts and what the costs might be upon their operations.”

Cybersecurity is Not Free

High costs, confusing guidance and low return on investment have all been cited as reasons for compliance challenges among defense contractors. Traditionally, DOD has declined to cover the costs associated with implementing acquisition regulations related to CUI cybersecurity, but that has slowly changed over the past 12 months as military contractors have faced unprecedented attacks from foreignsponsored hackers.

Last year, then-Deputy Secretary of Defense Patrick Shanah expressed reluctance on the part of DOD to help contractors cover added costs for cybersecurity, saying it should be a baseline expectation in contracts.

However, at a Professional Services Council event, Katie Arrington, special assistant to the assistant secretary for defense for acquisition for cyber, announced that the department would allow contractors to write off a portion of their cybersecurity spending for government contracts, including implementing NIST guidance.

Alan Chvotkin, executive vice president and counsel at the Professional Services Council, welcomed the shift, stating that it would be contradictory for DOD to refuse to provide financial incentives for cybersecurity while it is also expressing a desire to expand the number of businesses that make up the defense industrial base.

“To be a smart businessman, let alone a contractor, you ought to undertake this [level of security] because our adversaries are stealing everything,” Chvotkin said. “On the other hand, [DOD] is trying to entice nontraditional companies and small companies that otherwise … might not see the need to incur such significant costs to reach the level that is expected as a contractor or subcontractor.”

Still, it’s not clear how DID’s reimbursement policy will work, which contracts it would apply to or what percentage of a company’s costs would be covered.

A Shake-up of the Contracting Community

James Goepel, CEO and general counsel at cybersecurity consulting firm Fathom Cyber, told FCW he has serious doubts that many defense contractors will be ready by September 2020. For most companies, the associated costs are less about assets and technology and more about training employees and allocating personnel to map and formalize internal IT policies. The potential for an initial shock to the federal contracting system is real.

“I do think that it’s going to hurt us in the short term from a product-availability perspective,” said Goepel, who also teaches cybersecurity at Drexel University’s law and business schools. “The government is going to miss out on stuff, and there are going to be companies that go out of business because of this. But in the end, I think that it may actually be a better thing for country unfortunately.”

Metzger doesn’t go that far but believes a short-term effect could be the departure of some companies from the federal contracting space. The impact might be hardest on small and medium-sized businesses that have fewer financial resources and have typically avoided the level of scrutiny directed toward large prime contractors.

“I think the short-term impact is that companies of all sizes are going to be looking at affordable effective ways to improve their cybersecurity,” he said. “Nobody knows exactly today what you will need to do to get a security rates score of [1 to 5] ... I’m thinking that many companies will be targeting their investments and actions to be sure that when it comes into place they will get at least a 3.”

This article originally appeared in the October 2019 issue of Security Today.

Featured

  • Evolving Cybersecurity Strategies: Uniting Human Risk Management and Security Awareness Training

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

  • Report: 1 in 3 Easily Exploitable Vulnerabilities Found on Cloud Assets

    CyCognito recently released new research highlighting critical security vulnerabilities across cloud-hosted assets, revealing that one in three easily exploitable vulnerabilities or misconfigurations are found on cloud assets. As organizations increasingly shift to multi-cloud strategies, the findings underscore significant security gaps that could provide attackers with potential footholds into networks. Read Now

  • Built for Today, Ready for Tomorrow

    Selecting the right VMS is critical for any organization that depends on video surveillance to ensure safety, security and operational efficiency. While many organizations focus on immediate needs such as budget and deployment size, let us review some of the long-term considerations that can significantly impact a VMS's utility and flexibility. Read Now

  • Paving the Way to Smart Buildings

    In today's rapidly evolving security landscape, the convergence of on-prem, edge and cloud technologies are critical. The physical security landscape is undergoing a profound transformation, driven by the rapid digitalization of buildings and the evolving needs of modern organizations. As the buildings sector pivots towards smart, AI and data-driven operations, the integration of both edge and cloud technology has become crucial. Read Now

  • The Cybersecurity Time Bomb

    If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk. Read Now

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.