Are Contractors Ready for DOD’s Cybersecurity Framework?
The cybersecurity maturity model certification could have a profound impact on the procurement landscape when it goes live next year
- By Derek B. Johnson
- Oct 01, 2019
Contractors will face big changes and tight timelines next
year when the Defense Department institutes its new
Cyber Maturity Model Certification framework. Announced
by DOD officials in June, the framework seeks
to certify companies’ compliance with federal cybersecurity regulations
for controlled unclassified information (CUI). It will be used
to evaluate and rate contractors’ ability to protect sensitive data on a
scale of 1 to 5.
The initial version of the framework is scheduled to go public in
January 2020. By June, its requirements will start appearing in requests
for information, and it will become a regular feature of defense
procurement by September. That means defense contractors will have
less than eight months to implement the necessary changes to ensure
that they comply with the Defense Federal Acquisition Regulation
Supplement’s and the National Institute of Standards and Technology’s
guidance on protecting CUI.
“Any timeline would seem ambitious. One that looks to have this
in operation by 2020 [is] going to be difficult,” said Robert Metzger,
a lawyer specializing in government contracts and commercial litigation
and a consultant who focuses on supply chain security issues.
“Naturally, industry has a lot of questions about the mechanics…
Companies are understandably uncertain as to how these changes
will affect what they’re doing, how they will demonstrate eligibility
for contracts and what the costs might be upon their operations.”
Cybersecurity is Not Free
High costs, confusing guidance and low return on investment have
all been cited as reasons for compliance challenges among defense
contractors. Traditionally, DOD has declined to cover the costs associated
with implementing acquisition regulations related to CUI
cybersecurity, but that has slowly changed over the past 12 months as
military contractors have faced unprecedented attacks from foreignsponsored
Last year, then-Deputy Secretary of Defense Patrick Shanah expressed reluctance on the part of DOD to help contractors cover
added costs for cybersecurity, saying it should be a baseline expectation
However, at a Professional Services Council event, Katie Arrington,
special assistant to the assistant secretary for defense for
acquisition for cyber, announced that the department would allow
contractors to write off a portion of their cybersecurity spending for
government contracts, including implementing NIST guidance.
Alan Chvotkin, executive vice president and counsel at the Professional
Services Council, welcomed the shift, stating that it would be
contradictory for DOD to refuse to provide financial incentives for
cybersecurity while it is also expressing a desire to expand the number
of businesses that make up the defense industrial base.
“To be a smart businessman, let alone a contractor, you ought to
undertake this [level of security] because our adversaries are stealing
everything,” Chvotkin said. “On the other hand, [DOD] is trying to
entice nontraditional companies and small companies that otherwise
… might not see the need to incur such significant costs to reach the
level that is expected as a contractor or subcontractor.”
Still, it’s not clear how DID’s reimbursement policy will work,
which contracts it would apply to or what percentage of a company’s
costs would be covered.
A Shake-up of the Contracting Community
James Goepel, CEO and general counsel at cybersecurity consulting
firm Fathom Cyber, told FCW he has serious doubts that many defense
contractors will be ready by September 2020. For most companies,
the associated costs are less about assets and technology and
more about training employees and allocating personnel to map and
formalize internal IT policies. The potential for an initial shock to the
federal contracting system is real.
“I do think that it’s going to hurt us in the short term from a
product-availability perspective,” said Goepel, who also teaches cybersecurity
at Drexel University’s law and business schools. “The
government is going to miss out on stuff, and there are going to be
companies that go out of business because of this. But in the end, I
think that it may actually be a better thing for country unfortunately.”
Metzger doesn’t go that far but believes a short-term effect could
be the departure of some companies from the federal contracting
space. The impact might be hardest on small and medium-sized businesses
that have fewer financial resources and have typically avoided
the level of scrutiny directed toward large prime contractors.
“I think the short-term impact is that companies of all sizes are
going to be looking at affordable effective ways to improve their cybersecurity,”
he said. “Nobody knows exactly today what you will
need to do to get a security rates score of [1 to 5] ... I’m thinking that
many companies will be targeting their investments and actions to be
sure that when it comes into place they will get at least a 3.”
This article originally appeared in the October 2019 issue of Security Today.