The CMMC – A Palatable Enforcement Solution to DFARS Requirement?
My colleagues and I have been warning about the Department of Defense’s (DoD’s) looming enforcement of DFARS clause 252.204-7012 for a while now, as many Tripwire customers handle government CUI. Inevitably, we are asked how long we think it will be until enforcement takes place. Our response is that enforcement will take place when compliance oversight is driven from the top down.
Based on DoD’s May 23rd announcement, that’s exactly what’s happening. The good news is that the initial solution appears to be palatable.
In January of this year, Under Secretary for Defense Ellen M. Lord communicated her intent to audit the DoD supply chain for compliance to DFARS clause 252.204-7012. Later that month, during a hearing of the Senate Armed Services Committee, DoD CIO Dana Deasy suggested that compliance enforcement would be modeled after industry and could include a combination of validating certification of supplier systems, helping subcontractors strengthen their cyber hygiene and applying AI to identify areas of the greatest vulnerability.
Last month’s announcement of the Cyber Security Maturity Model Certification (CMMC) is the result.
What makes this so interesting (and hopeful) for those of us at Tripwire is that, with the CMMC, DoD appears to be addressing our customers’ core compliance pain points:
- Varying standards — It’s not always easy to read and/or interpret the DFARS standards. Under the new CMMC compliance, there will be ONE unified DoD cybersecurity standard that combines NIST SP 800-171, NIST SP 800-53, AIA MAS 9933, FIPS and others. In other words—one standard, one maturity model.
- Varying levels of security – CMMC requirements will not be “all or nothing.” There will be a range of CMMC compliance. RFPs will reflect what level is needed by DoD for each contract.
- Affordability — Security will now be an allowable cost (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Thomas Taylor. Read the original post at: https://www.tripwire.com/state-of-security/government/cmmc-palatable-enforcement-solution-dfars-requirement/
