Coronavirus Will Not Delay Pentagon’s Contractor Cybersecurity Program, Official Says

The Defense Department officially entered into an agreement with the nonprofit corporation that will serve as the accreditation body for its Cybersecurity Maturity Model Certification program, the chief information security officer for the department’s acquisition office confirmed. 

“Yesterday the CMMC accreditation body made a public post that we have executed the [memorandum of understanding],”  said Katie Arrington, who is spearheading the program and participated in a webcast on the issue Thursday. 

A resolute Arrington sought to quash any idea that the government’s efforts to contain the coronavirus pandemic would delay the Defense Department’s plan to validate contractors’ cybersecurity claims using independent third-party auditors. 

“We, all of us that are mission-essential, have been working on COVID-19, but,” she said, “although we are working diligently to ensure we are doing our best in the Department of Defense to save lives, work does continue and we are not slowing our roll at all.”

Arrington and other webinar participants noted the extensive impact the CMMC is expected to make across the federal government, its contractors and international partners.

The CMMC standard is built primarily on National Institute of Standards and Technology Special Publications such as 800-171 and 800-53, to which defense contractors have so-far been self-attesting their compliance. But, as Arrington said, the CMMC is augmented by standards used in the United Kingdom, Australia and the European Union.

“We didn’t want to create something, a unified standard for maturity, that wasn’t inclusive of everything that we could possibly find,” Arrington said.

The need for a unified standard tracks with global conversations about cybersecurity, said Norma Krayem, vice president and chair for the cybersecurity, privacy and digital innovation practice group at Van Scoyoc Associates.

“No one likes new regulations,” Krayem noted, but said the tone at venues like the World Economic Forum in Davos, Switzerland, is whether the voluntary system the U.S. has largely relied on so far has been effective for ensuring protections are in place. 

Within the U.S., Krayem observed how the CMMC’s ideals are reflected in recent recommendations issued by the Congressionally-mandated Cyberspace Solarium Commission. 

She noted the commission recommends codifying the definition of critical infrastructure and establishing liability for the companies that fall under it. The commission also recommended a labeling and certification scheme, she said.

Mary Beth Bosco, a partner at the law firm Holland and Knight, said civilian agencies currently have a range of requirements of their own but that she expects they would all ultimately fall in line behind DOD. 

“It’s quite in a state of flux,” she said, “but I think what you can expect as CMMC rolls out at DOD [is] that the [Federal Acquisition Regulation] council and the civilian agencies will probably lag along but eventually follow a very similar model.” 

Arrington added that the purpose of the Federal Acquisition Security Council, established by the Secure Technology Act, “is to unify those standards.”

“So you can absolutely expect that federal agencies are going to let us, with the CMMC lead the charge, but they are absolutely looking to adopt the model as their own as well as our international partners,” Arrington said.

Leaders of the accreditation body shared progress the group was making establishing working groups that would determine the shape of training for auditors—which will now have to be conducted online—among other considerations. 

“The CMMC-AB is pleased to announce that it has mutually signed the Memorandum of Understanding (MOU) with the Department of Defense,” reads a statement the body released Wednesday night. “We are working to make additional information available to the public in conjunction with our DoD partners, who are necessarily focused on the COVID-19 public crisis.” 

The optimism and resolve of the webinar’s participants were somewhat overshadowed by the harsh reality of the pandemic. 

As Arrington reassured the audience “the [accreditation body] and us have been working a tremendous amount in the virtual environment, and nothing is slowing down,” the audio quality of the webcast became increasingly unintelligible.   

The host noted the poor connection was due to Zoom, the conference technology, being overloaded on the East Coast.

“CMMC remains a priority for the department, and Ms. Katie Arrington continues to work closely with the accreditation body and industry,” department spokesman Lt Col Mike Andrews told Nextgov. “We don’t anticipate any impacts to the CMMC timeline due to COVID-19, but with the social distancing guidelines we are postponing any public events.”

Help us understand the situation better. Are you a federal employee or contractor with information about how your agency is handling the coronavirus? Email us at newstips@nextgov.com.