CMMC Readiness CMMC Readiness for Manufacturers - Stay competitive in Defense Contracting

CMMC stands for Cybersecurity Maturity Model Certification. CMMC is a federal regulatory program required by the Department of Defense. This program requires all suppliers selling to the DoD to obtain certification proving that their cybersecurity systems are sufficient to protect the sensitive government information involved with DoD contracts.

If you are a contractor, manufacturer, supplier, reseller, distributor, or service provider to any Department of Defense entity, and if your contracts to these entities include specific FAR and DFARS clauses, you are required to be CMMC compliant and eventually CMMC certified. If you are handling Controlled Unclassified Information, then you will need to be compliant.

The government defines it as “Controlled Unclassified Information (CUI) is sensitive information that the government creates or possesses, which requires safeguarding or dissemination controls according to laws, regulations, or government-wide policies, but is not classified.” To put it another way, this is sensitive information that belongs to the government, and it is their responsibility to protect the confidentiality of the information. Note that any derivative works, meaning the incorporation of elements from the original CUI into other items, should also be considered CUI and protected in the same way.

FAR stands for Federal Acquisition Regulation while DFARS stands for Defense Federal Acquisition Regulation Supplement. These are contractual mandates that have requirements associated with them. Clauses such as FAR 52.204-21, DFARS 252.204-7012, DFARS 252.204.7019, DFARS 252.204-7020, DFARS 252.204-7021, and DFARS 252.239-7010 are the most common clauses that are associated with CMMC. If these are in your contracts, you must comply with CMMC requirements. While legislation is working to replace the FAR and DFARS clauses with CMMC specific language, it is expected that it may take time for the old clauses to go away.

Suppliers pursuing CMMC certification are required meet the required level of CMMC based upon the type of products and services that they will be providing within the Defense Industrial Base (DiB). Often, a manufacturer will be instructed by their customer (or directly from the Government) on what level to achieve through contracts (FAR and DFARS clauses) or through solicitations. The contracts and solicitations will dictate to what level of CMMC you will be required to achieve. Once you understand the level at which you are required, you must implement the requirements for the given level at which you are being required.

This group is responsible for conducting the assessments for suppliers requiring CMMC Level 2 certification. The certification process will require assessors to review how you are meeting the requirements and decide on granting formal certification. In general, CMMC certifications are conducted every three years, but organizations must self-assess and attest that they are meeting requirements on an annual basis.

CMMC Compliance calls for companies to meet one of three levels. Level 1 is the Foundational tier, requiring suppliers to comply with 17 cybersecurity practices and to self-assess their compliance. Level 2 is the Advanced tier, requiring suppliers to comply with 110 practices and to maintain certification through third-party assessments every three years. Level 3 is the Expert tier, requiring suppliers to comply with over 110 practices and maintain certification through official government-provided assessments every three years.

The CMMC readiness process can take 3-24 months on average, depending on the certification level desired, the client's existing level of preparedness, and the amount of time the client needs to roll out changes. Major cybersecurity changes can be disruptive to any organization’s ongoing business operations and need ample time to deploy. CMMC certification can often take 6-12 months to secure a third-party assessor, which makes scheduling the CMMC certification well in advance so important.

Suppliers who sell directly to the DoD must be CMMC compliant, and suppliers who sell to any other organization in the defense supply chain, even if not engaged with the DoD directly, must be compliant as well. Indirect suppliers must check their contracts and any referenced prime contracts for FAR and DFARS clauses requiring CMMC compliance and in many cases, a CMMC certification.

Some organizations may on sub-contractors to provide goods and services where data may need to be exchanged. When this exchange of data occurs and if the data is categorized as Controlled Unclassified Information (CUI), then those sub-contractors will also be required to meet the same compliance requirements as you. There are clear requirements to perform what is called “flow-down” in contracts for these sub-contractors who will be working with CUI. 

If your contracts do not include CMMC related references, then you are not required to be CMMC compliant or potentially need to be certified. However, cybersecurity is a real threat to all manufacturers and suppliers regardless of the industry they work in. For this reason, all businesses must assess their risk of cyber threats and take responsible action to defend against these threats for the protection of themselves, their clients, and their stakeholders. If you are not required to meet CMMC today, you likely need to adhere to other requirements because they are relying on you to safeguard their data or meeting specific service level agreements.

NIST stands for the National Institutes of Standards and Technology and this government entity is charged with providing industry best practices, among other things. NIST has created the underlying compliance framework for CMMC known as 800-171 and 800-172. Frameworks provide the guidance for meeting requirements for CMMC.

If Defense Suppliers are required to become compliant and choose not to go through the certification process, then they will risk losing current and future business. Suppliers will not be able to bid on new contract opportunities, and any existing contracts in process may be subject to revision or revocation until certification is obtained.