DOD Focuses on Minimizing Cyber Threats to Department, Contractors

The CMMC, Lord said, is the DOD's metric to measure a company's ability to secure its supply chain from cyber threats, protecting both the company and the department.

The department is now focused on implementing the CMMC. Lord said these efforts support the Defense Federal Acquisition Regulation Supplement rulemaking process while completing a no-cost contract with the newly established CMMC accreditation body, registering and training candidate CMMC third-party assessment organization assessors, conducting risk reduction through CMMC pathfinder and pilot programs and developing the CMMC database infrastructure.

As part of CMMC, the accreditation body will accredit third-party assessment organizations, or C3PAOs, to evaluate a business's compliance with CMMC standards. The CMMC-AB started registering such third-party assessors in June, Lord said.

{{slideNumber}}/{{numSlides}} - {{slideCaption}}

SHARE IMAGE:

a v-bind:href="originalUrl" v-bind:title="slideTitle" target="_blank" rel="noopener" class="action-frame article-link"> Download Image

Image Details

Photo By: {{photographer}}

VIRIN: {{virin}}

{{ slideNumber}}/{{numSlides}} {{slideTitle}} - {{slideCaption}}

{{slideInfo.slideNumber}}/{{numSlides}} {{slideInfo.slideTitle}} - {{slideInfo.slideCaption}}

Lord also said the Office of the Chief Information Security Officer for Acquisition and the Missile Defense Agency are now also completing a CMMC pathfinder on an existing contract, which involves acquisition tabletop exercises, training of mock assessors and conducting mock assessments of a prime contractor and three subcontractors. These efforts, she said, are for evaluation only and are non-punitive and not for attribution.

The OCISO-A and another DOD stakeholder will begin a second CMMC assessment pathfinder on an existing contract in September. That second pathfinder will also be nonpunitive and not for attribution, she said. The OCISO-A is also looking for other contracts on which to conduct CMMC pilot projects.

"These pilots will be implemented on new DOD contracts to further reduce the risk of CMMC phased rollout, by focusing on the flow-down of controlled unclassified information ... and CMMC requirements through the supply chain and conduct of mock CMMC assessments," she said.

Tech Development

The U.S. Army Research Laboratory uses the “Shaker” to conduct experiments in multiaxial vibrations and develop technology to mitigate the danger it could cause to vehicles and structures, Sept. 26, 2019.

SHARE IMAGE:

Download Image

Image Details

Photo By: David McNally, Army

VIRIN: 180926-A-GX166-228

As part of developing the CMMC database infrastructure, Lord said, the department is now working with the Defense Information Systems Agency's Enterprise Mission Assurance Support Service to develop "CMMC EMASS," which will serve as the infrastructure for CMMC assessment reports, certificates and data analytics.

"The initial development for this is planned to start this month," she said. "The certification body will train and credential candidate-assessors and accredit CMMC third-party assessment organizations. In fact, the first CMMC training course for candidate-assessors is also on track for this month."