DoD Releases Version 0.6 of its Cybersecurity Maturity Model Certification

By Susan B. Cassidy & Ryan Burnette on November 13, 2019

Posted in Cybersecurity, Defense Industry, Procurement Policy

On November 7, the Office of the Assistant Secretary of Defense for Acquisition released Version 0.6 of its draft Cybersecurity Maturity Model Certification (CMMC) for public comment. The CMMC was created in response to growing concerns by Congress and within DoD over the increased presence of cyber threats and intrusions aimed at the Defense Industrial Base (DIB) and its supply chains.

The model updates Version 0.4, which DoD released on September 4, 2019, and which we wrote about here. The CMMC establishes the framework necessary for contractors to obtain one of five certification levels necessary to perform work on certain DoD contracts, including those that require the handling of Controlled Unclassified Information. Whereas Version 0.4 merely listed the capabilities, controls, and processes that were expected to apply to each certification level, this version provides some additional discussion and clarification to assist contractors with meeting Level 1 certifications.

DoD has not explicitly asked for comment on this version of the CMMC, and has stated that the updated model is being released “so that the public can review the draft model and begin to prepare for the eventual CMMC roll out.” For this reason, although additional changes are to be expected to the model, contractors should review the general requirements closely to ensure that they are positioned to continue bidding on DoD contracts once DoD begins including a requirement to obtain a specific certification level in Requests for Proposal in Fall 2020.

Overview of the Updated Model

Highlighting the importance of this document, Version 0.4 of the CMMC received more than 2,000 comments from industry. Version 0.6 is limited to updating Levels 1 through 3 because DoD is still processing comments with regard to Levels 4 and 5. Levels 4 and 5 are focused on “reducing the risk of advanced persistence threats and are intended to protect CUI associated with DoD critical programs and technologies.” DoD is separately determining how to define critical programs and technologies for these purposes and whether to make such a list public.

The CMMC builds upon existing regulatory security controls, including NIST Special Publication (SP) 800-171 rev 1, Draft NIST SP 800-171B, the United Kingdom’s Cyber Essentials, and Australia’s Essential Eight, among others. At its core, the current version of the CMMC framework consists of a matrix, composed of “Domains,” “Capabilities,” and “Practices and Processes.” Domains are comprised of Capabilities, and Capabilities are comprised of Practices and Processes. Capabilities are achievements to ensure cybersecurity objectives are met within each domain. Practices will measure the technical steps needed to achieve compliance with a given capability requirement and processes will measure the maturity of a company’s processes.

The Five Levels of the CMMC, using DoD’s terminology, are summarized as follows:

CMMC LEVEL	PRACTICES	PROCESSES	Process Maturity
Level 1	Basic Cyber Hygiene	Performed	No maturity processes
Level 2	Intermediate Cyber Hygiene	Documented	Establishes policies, practices, and plans
Level 3	Good Cyber Hygiene	Managed	Reviews activities for adherence to policy and practices; provides adequate resources
Level 4	Proactive	Reviewed	Reviews and measure activities for effectiveness; information provided to high-level management of any issues
Level 5	Advanced / Progressive	Optimized	Standardized documented approach; shares improvements across the organization

DIB contractors will be accredited under the CMMC only if they can both demonstrate compliance with the required practices and demonstrate mature processes as required for the given CMMC level. Adherence to the CMMC processes and practices is cumulative. To achieve a specific level of the CMMC, an organization must meet both the practices and processes within that level and levels below across all of the domains of the model. As an example, the CMMC notes that an organization that scores a Level 3 on practice implementation and a Level 2 on process institutionalization, will be assigned a CMMC Level 2.

Level 1

This level focuses on basic cyber hygiene and consists of the safeguarding requirements specified in FAR 52.204-21 – the Basic Safeguarding clause that is designed to impose security controls to protect Federal Contract Information (FCI). Organizations at both Level 1 and 2 may receive FCI. At this level, DoD recognizes that an organization may have limited or inconsistent cybersecurity maturity.

Level 2

Level 2 contractors meet Level 1 requirements and have standard operating procedures, policies, and strategic plans to guide the implementation of their cybersecurity program, all which gives the organization a greater ability to withstand cyber threats than Level 1 organizations.

Level 3

Contractors at Level 3 meet Levels 1 and 2 and will have demonstrated good cyber hygiene and effective implementation of the security requirements of NIST SP 800-171 Rev 1. Organizations that require access to controlled unclassified information (CUI) and/or generate CUI should achieve CMMC Level 3. “CMMC Level 3 indicates a basic ability to protect and sustain an organization’s assets and CUI; however, at CMMC Level 3, organizations will have challenges defending against advanced persistent threats (APTs).”

Levels 4 and 5

At CMMC Level 4 and 5, an organization has a “substantial and proactive cybersecurity program.” These organizations have the capabilities to address attacks from APTs. For process maturity, “the organization is expected to review and document activities for effectiveness and inform high-level management of any issues as well as ensure that process implementation has been generally optimized across the organization.”

Version 0.6 also includes Appendix B, which provides a discussion and clarification for the CMMC Level 1 practices that map to the safeguarding requirements in FAR 52.204-21, Basic Safeguarding of Covered Contactor Information Systems. Each practice includes references, a discussion of the control, a classification explanation, and an example. The CMMC notes that the examples are only intended to “help explain the practices and do not reflect guidance.”

The current version also contains a glossary. Some of the terms defined in the glossary are in addition to those currently associated with the DFARS 252.204-7012 clause. For example, both the clause and the CMMC have a broad definition of “incident,” to include potential incidents. In contrast, the glossary also has a definition of “breach,” which is limited to an incident where an adversary has (1) gained access to the network, and (2) results in the loss of information, data or asset. This glossary may provide some insight into new versions of the CMMC.

Unlike NIST SP 800-171, which is implemented through a regulation — i.e., DFARS clause 252.204-7012 — DoD plans to implement the requirements of the model on a purely contractual basis. The required CMMC level applicable to a procurement will be listed in the solicitation in sections “L” and “M” and will be a “go/no-go decision,” meaning that if the appropriate certification is not obtained by a contractor, that contractor will not be eligible for the work. DoD officials have stated that they may allow a contractor to submit a bid prior to obtaining certification under the requirement that the certification must be obtained for the work to begin.

Open Questions and Issues for Contractors

Version 0.6 provides further insight into the approach that DoD will be taking with regard to its certification model, but there still remain significant questions:

Level 4 and 5 Certifications. Those contractors that work on the most sensitive DoD programs will presumably be subject to compliance with heightened protection requirements of Level 4 or 5 certifications. However, DoD has yet to issue updated requirements for obtaining these certification levels, only noting that it is still addressing public comments and that the updates will be included in a future release. The delay by DoD in developing these added requirements and the expected difficulty in implementing some of these higher level controls could make it more challenging for contractors to ensure that they have the appropriate Practices and Processes in place when the model becomes effective. DoD has noted that a contractor can appropriately infer that a program includes critical programs and technologies if it requires a Level 4 or 5 certification.
Schedule and Timeline of Certifications. DoD intends to use independent third party organizations to conduct audits and to certify contractors. However, DoD has not yet released the assessment guidance for these third-party certifiers or chosen an accreditation agency. DoD has continued to list a handful of agencies as examples of accreditors, but it remains unclear if one or multiple organizations will be given the role of certifier. Given DoD’s estimate of 300,000 contractors that will require certification, this would appear to be the long pole in the tent. Even if DoD is able to set up an initial base of auditors to complete these assessments, there will be an issue of quality control between the various accreditation agencies if multiple are selected. Also, there likely will be an immediate backlog of contractors that require certifications once the model is effective. While DoD has indicated that it will permit contractors to bid on contracts while they await a certification, DoD still expects contractors to be certified at the time they actually start work. It therefore remains unclear how DoD will handle the situation where work is delayed because a contractor is awaiting a certification decision through no fault of its own.
New controls. The CMMC introduces a significant number of new controls and requirements. Even the most sophisticated of contractors will likely find compliance challenging. For example, the UK and Australian controls[1] are new for purposes of the CMMC and there is no guidance on how DoD intends they be implemented. Similarly, Version 0.6 references NIST SP 800-171B in the introductory text, which remains in draft form. Although the clarifications that DoD has included in this version may assist contractors with coming into compliance with these new controls and requirements, DoD has stated that Version 1.0 will only have clarifications for Levels 1 and 2.
Determination of Appropriate CMMC Level for Contracts. Version 0.6 offers no insight into how DoD will determine the CMMC certification level required for each contract solicitation or whether it intends to standardize a process for making such determinations across the Departments or even within requiring activities. Existing FAQs on DoD’s CMMC website only state that “[t]he government will determine the appropriate tier (i.e. not everything requires the highest level) for the contracts they administer.”
Allowable Costs. This version of the model does not address costs in any meaningful way. DoD has consistently said that the costs of compliance with the CMMC would be allowable. Presumably these costs would be recovered in contractors’ overhead rates, but DoD has suggested that some aspects of compliance costs may be treated as direct costs. However, to the extent that commercial item contractors — including many small business — contract with the government on a price basis, the costs of implementation would not be separately reimbursable by the government. While DoD has continued to note that funding, such as funds from DPA Title III, will be made available to assist small business with compliance, no public information on this possibility has been released to date.

[1] Since October 1, 2014, the UK Government has required all suppliers bidding for contracts involving the handling of certain sensitive and personal information to be certified against the Cyber Essentials scheme, a set of basic technical controls to help organizations protect themselves against common online security threats. The Government of Australia’s Essential Eight includes controls such as application whitelisting and multi-factor authentication, that make it more difficult for adversaries to compromise systems.