CMMC Official Backs Light-touch Option for Continuous Monitoring of Defense Contractors’ Cybersecurity

gokturk_06/Shutterstock

The Pentagon’s certification program is looking for a way to keep tabs on companies during the three-year intervals between independent audits.

The accreditation body responsible for certifying companies’ adherence to the Defense Department’s coming Cybersecurity Maturity Model Certification program is deliberating over a partner to continuously monitor contractors’ cybersecurity posture, and sympathizes with industry leaders who are hoping a light-touch approach will win.

Under the CMMC, Defense contractors will have to renew their certifications every three years. 

“That’s a snapshot in time, there’s a whole bunch of things that can happen in that three year period,” said Chris Golden. “Companies can go from 100% on-[premises] to 100% cloud, there could be a complete changeover in leadership, they could move operating systems...so we have to have some mechanism to give us an idea of what is going on inside the firewall without putting an agent on their networks because, frankly, most companies would not allow that.” 

Golden is a member of the board for the CMMC Accreditation Body. He spoke Wednesday during a webinar hosted by the security ratings company SecurityScorecard, which seems to fit Golden’s description for a desired continuous monitoring solution. 

Steve Shirley, the executive director of the National Defense Information Sharing and Analysis Center and vice chair of the Defense Industrial Base Sector Coordinating Council; Jennifer Gillespie, a senior associate for information services governance with Booz Allen Hamilton; and Robert Knake, a senior fellow for cyber policy at the Council on Foreign Relations and a former director of cybersecurity policy on President Obama’s National Security Council, also participated in the event.

With a rule change to Defense acquisition regulations expected in the fall, contractors handling information with a certain level of sensitivity will have to undergo an independent audit to ensure their cybersecurity is up to snuff. 

The speakers all agreed that the current system, where companies “self-attest” to meeting data security standards set by the National Institute of Standards and Technologies, has been unreliable, with companies broadly misrepresenting their defenses.    

Gillespie said the CMMC is a “desperately needed evolution of the [Defense Federal Acquisition Regulations]” and that she is excited by the prospect of it being adopted by civilian agencies across the government. In that vein, the General Services Administration has already reserved the right to implement the CMMC in finalizing a major IT contracting vehicle.  

SecurityScorecard General Counsel Sachin Bansal demurred when Nextgov asked whether the company was a contender to provide continuous monitoring for the CMMC, but Golden and industry leaders praised the company’s approach.

“One of the things my member companies find attractive about SecurityScorecard is that there’s a way to assert that there is a monitoring capability,” Shirley said, “and it’s a reasonable touch on their networks, and their interests and is short of some very intrusive schema that other entities have proposed.”

Knake said, ultimately, a tool that is able to collect data from within a company’s network and report it back out to stakeholders would be the most beneficial, but that the service provided by SecurityScorecard, which uses publicly available data such as how often and quickly a company patches reported vulnerabilities, is an important intermediate step toward a new way of assessing security compliance.

“I think we probably won’t see a sensor moving inside the network, I think we probably will see some form of data collector moving inside the network and bringing data out that can tell you where you are and can tell DOD where you are, or other regulators or other third parties,” he said. “I think what we see right now is the use of external tools, like SecurityScorecard, pointing the way to that, showing how much value you get when you can do this on a continuous basis, so it sort of logically has led many people to say yes, I want that, and then I also want that for what’s happening inside the network.”

Most of the components of CMMC, or programs such as the Federal Risk and Authorization Management Program, can be measured on a continuous, automated basis, Knake said, predicting the future will see more demand for internal network scrutiny.

“I think that’s probably where we’re headed,” he said. “In the crawl, walk, run stages, we’re now getting up to walking and what I’m talking about there would be running. So I think we’re probably a few years away from that but I think it’s gonna come.”     

For now, Golden said the CMMC accreditation body is more interested in “some kind of monitoring tool that grabs the data that’s out in the ether, out in the public domain that gives us some insight into what’s going on...as companies evolve.”  

RELATED PODCAST

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.