CMMC ecosystem faces challenges as industry awaits decision from DOD CIO Davies on next steps

Matthew Travis, chief executive officer at the Cyber AB, attempted to take an optimistic tone in his welcoming remarks on Oct. 22 at the CS5 East conference, while acknowledging that there will be changes to the program once DOD CIO Kirsten Davies announces what is next following the pause. Travis compared the CMMC program to flying a plane, emphasizing that the pause, which started on July 13, is an “unscheduled emergency landing for repairs.” When the task force comes back with recommendations and decisions on the future of the program are made, Travis said, he doesn’t expect that the assessment ecosystem will “just kind of go back [to] what we were doing.

I don't think that's going to be the case.” “I certainly expect and hope that there was still a compelling role for third parties,” Travis said, including third party assessors, training providers, registered practitioners and registered provider organizations. He said, “I expect that to be the case, but I can't guarantee that.” The CMMC level two pause has impacted third party assessment organizations who have invested thousands of dollars to prepare for conducting third party assessments of companies who want to compete for DOD contracts with a level two requirement, with some assessors and companies starting to consider whether to pivot to other assessments such as ISO standards or compliance with the Federal Information Security Modernization Act. The Office of the DOD CIO has touted the volume of input received from a July 13 request for information to get feedback potential changes the program, but sources say there are perennial problems that are most apparent, including the inconsistent marking of controlled unclassified information at DOD.

The CMMC Program Management Office has also experienced challenges in the past few months and seen major departures, including the PMO director Buddy Dees, with a small staff that has not received support under Davies, according to sources. Davies and acquisition officials have noted that the current pause doesn’t impact the need for defense contractors who hold CUI to reach compliance with NIST Special Publication 800-171, which has been the DOD standard since Dec. 31, 2017.

The CMMC program attempted to add a verification mechanism where companies would need to obtain a third party assessment and receive a certification to compete for defense contracts. On an Oct. 22 panel at the conference, attorney Eric Crusius recommended that companies still move forward with getting a CMMC assessment if they can afford it.

By getting an assessment, Crusius said it would be harder for the Justice Department to argue that a company has been “reckless” under a False Claims Act lawsuit concerning NIST 800-171 compliance and the company would not be a “target” by DOJ. Crusius is a partner at law firm Hunton Andrews Kurth. The panel also discussed how the rest of the federal government is looking at CUI, amid a pending rulemaking to revise the Federal Acquisition Regulation.

Crusius was joined by Michael Gruden of law firm Steptoe, James Gatewood of Davidson Technologies and moderator Mike Snyder of the Cyber AB. Sources noted that more evaluations of compliance with NIST 800-171 could come from the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center during the current pause. As a result, industry sources said some companies are still looking for a CMMC certification through a third-party assessment organization.