CMMC Readiness CMMC Readiness for Manufacturers - Stay competitive in Defense Contracting

CMMC stands for Cybersecurity Maturity Model Certification. CMMC is a federal regulatory program required by the Department of Defense. This program requires all suppliers selling to the DoD to obtain certification proving that their cybersecurity systems are sufficient to protect the sensitive government information involved with DoD contracts.

If you are a contractor, manufacturer, supplier, reseller, distributor, or service provider to any Department of Defense entity, and if your contracts to these entities include what is called the "DFARS Clause", you are required to be CMMC compliant and / or CMMC certified.

DFARS stands for Defense Federal Acquisition Regulation Supplement, which are regulation statements referenced in official contracts with the DoD and related agencies. The new DFARS clause #252.204-7021 "Cybersecurity Maturity Model Certification Requirements" has recently been added to DoD contracts, requiring CMMC compliance. Suppliers are informally calling this the "DFARS Clause" or "DFARS Cybersecurity Clause" since it's so new and important.

Suppliers pursuing CMMC certification are required to pick a CMMC Level that they will adopt, and then complete all of the necessary requirements to achieve that level. In most cases, clients have to perform a combination of new process development and existing process improvements in order to meet technical CMMC standards.

CMMC Compliance calls for companies to meet one of three levels. Level 1 is the Foundational tier, requiring suppliers to comply with 17 cybersecurity practices and to self-assess their compliance. Level 2 is the Advanced tier, requiring suppliers to comply with 110 practices and to maintain certification through third-party assessments every three years. Level 3 is the Expert tier, requiring suppliers to comply with over 110 practices and maintain certification through official government-provided assessments every three years.

The CMMC readiness process can take between 3-24 months on average, depending on the certification level desired, the client's existing level of preparedness, and the amount of time the client needs to roll out changes. Major cybersecurity changes can be disruptive to any organization’s ongoing business operations and need ample time to deploy. CMMC certification can often take 6-12 months to secure a third-party assessor, which makes scheduling the CMMC certification well in advance so important.

Suppliers who sell directly to the DoD must be CMMC compliant, and suppliers who sell to any other organization in the defense supply chain even if not engaged with the DoD directly must be compliant as well. Indirect suppliers must check their contracts and any referenced prime contracts for language regarding DFARS 7021 and CMMC Certification.

If your contracts do not include any reference to DFARS 7021 or CMMC, then you are not required to be CMMC certified. However, cybersecurity is a real threat to all manufacturers and suppliers regardless of the industry they work in. For this reason, all businesses must assess their risk of cyber threats and take responsible action to defend against these threats for the protection of themselves, their clients, and their stakeholders.

As with most federal regulations, CMMC codes are built upon and reference external technical standards developed by the separate agency NIST. The NIST, or National Institute of Standards and Technology, publishes their own cybersecurity codes known as NIST 800-171 and NIST 800-172, which the CMMC standards are based on.

Defense suppliers that are required to be CMMC certified but do not obtain certification will be considered ineligible for entering into DFARS-governed contracts with the Department of Defense. Such suppliers will not be able to bid on new contract opportunities, and any existing contracts in process may be subject to revision or revocation until certification is obtained.