Defense Department Certification Body Could Itself Conduct Audits Under Interim Rule

A long awaited rule to implement the Defense Department’s Cybersecurity Maturity Model Certification, or CMMC, program provides initial insight into what the adjudication of disputes will look like and includes the possibility of a nonprofit accreditation body conducting assessments.

Right now, if prospective contractors want to do business with the Defense Department, they generally just have to pledge they’re adhering to security requirements laid out by the National Institute of Standards and Technology in order to protect certain sensitive information. The new rule, set to publish Tuesday in the Federal Register, will require contractors handling such information be audited by an independent third party. 

It will take effect in 60 days but be subject to a five-year phase-in period during which contracting officers will have to gain approval from the DOD’s acquisitions office in order to include the CMMC in solicitations.

The Defense Department has its own auditors, who operate out of the Defense Contract Management Agency, but the rule described a need to establish a nonprofit accreditation body in order to handle the volume of companies—at least 220,966 known unique prime and subcontractors—that would ultimately need to be certified. DOD expects 1,110 of these will be finished within the first year of the rule taking effect.

“CMMC addresses the challenges of the Department scaling its organic assessment capability by partnering with an independent, non-profit CMMC-AB that will accredit and oversee multiple third party assessment organizations (C3PAOs) which in turn, will conduct on-site assessments of DoD contractors throughout the multi-tier supply chain,” according to the rule.

But the rule goes on to say the CMMC-AB may also be involved in conducting audits, in a scenario that is front of mind for members of the Information Technology Industry Council. The group includes major cloud service providers that worry the average auditor won’t grasp the nuances of their cybersecurity methods and notes resources they’ve already poured into achieving certification under the Federal Risk and Authorization Management Program, better known as FedRAMP. 

“If a contractor disputes the outcome of a C3PAO assessment, the contractor may submit a dispute adjudication request to the CMMC-AB along with supporting information related to claimed errors, malfeasance, or ethical lapses by the C3PAO,” the rule states. “The CMMC-AB will follow a formal process to review the adjudication request and provide a preliminary evaluation to the contractor and C3PAO. If the contractor does not accept the CMMC-AB preliminary finding, the contractor may request an additional assessment by the CMMC-AB staff.” 

Over the weekend, asked about reciprocity for FedRAMP and various other certification programs, Katie Arrington, the DOD’s CMMC lead, told Government Matters a legal agreement between the accreditation body and the C3PAOs is currently being negotiated.

“The legal function of reciprocity lies with the AB to the C3PAO, so they’re working that out now,” she said. “That legal agreement—because it’s all an assumption of risk—is being worked out right now." 

Eric Crusius, a partner at Holland and Knight, has been closely watching the process unfold.

“There is a lot of gray about the legal responsibilities between the contractor, assessor, assessor’s employer, and the CMMC Accreditation Board and what legal rights contractors have if they disagree with an assessment and that prevents the contractor from obtaining a contract,” he told Nextgov. “The AB was requiring assessors to carry insurance and this may be one of the reasons why.”

The CMMC AB has promised more information on the adjudication process. 

Beyond CMMC, the rule requires contractors for which compliance with NIST Special Publication 800-171 is necessary to open themselves up to a DOD review if they want medium- or high-level work.

“The new DFARS clause 252.204-7020 requires a contractor to provide the Government with access to its facilities, systems, and personnel when it is necessary for DoD to conduct or renew a higher-level Assessment,” it states.

Comments are due in 60 days on the interim rule and will be considered in preparation of a final rule that will be issued before the end of the year.