Defense Department is Seeking Industry Comments on a Draft of the Cybersecurity Maturity Model Certification (CMMC)

The Defense Department is seeking industry comments on a draft of the Cybersecurity Maturity Model Certification (CMMC), which would be mandatory for every one of the estimated 300,000 suppliers and contractors that make up the department’s supply chain.

The CMMC will consist of five distinct certifications, or levels, of cybersecurity rigor, ranging from adherence to baseline security controls and best practices, to sophisticated cyber defenses capable of repelling even the most advanced threats:

• Level 1 – Basic. The vendor performs a basic subset of cybersecurity best practices in an ad hoc manner, offering limited resistance against threats.
• Level 2 – Intermediate. The vendor implements and documents all universally-recognized best practices, offering some resistance against threats.
• Level 3 – Good. The vendor covers and actively maintains all security controls required by the National Institute of Standards and Technology’s cybersecurity framework (SP 800-171) for controlled, unclassified information, offering moderate resistance against threats.
• Level 4 – Proactive. The vendor regularly reviews and improves security controls and processes. They also rely on automated security controls capable of responding to threats faster than human analysts, offering strong resistance against all but the most advanced threats.
• Level 5 – Advanced/progressive. The vendor continuously improves security processes. It also relies on automated security controls and analytics, and offers strong resistance to even the most sophisticated cyber attackers.

Comments are due by September 25, 2019, and can be submitted via email to osd.pentagon.ousd-a-s.mbx.cmmc@mail.mil.

Advocacy contact: Major Clark at (202) 205-7150