Join | Member Login
Arlington (VA) Chamber of Commerce | Arlington, VA 22201
  • Membership
    • Membership Benefits
    • Join Now!
    • Chamber Assisted Grand Openings
    • Chamber Member Retirement Program
    • ShopChamber
    • Advertising >
      • Website Ads
      • E-Newsletter Ads
      • Print Ads
    • Arlingtonopoly
    • Committees
    • LeadShare
    • Annual Corporate Sponsors
    • Member Login
  • Business Directory
  • Events
    • Chamber Calendar
    • Community Calendar >
      • Submit a Community Event
    • Networking Events >
      • Chamber 101
      • Breakfast Connection
      • Business After Business
    • Signature Events >
      • Arlington Business Gala
      • Hospitality Awards
      • Legislative Breakfast
      • Arlington Chamber Volunteer Day
      • AWE Women in Business Summit
      • Best Business Awards
      • State of the County & Public Safety Awards
      • Annual Meeting
    • Educational Events
    • Women in Business
    • Travel
    • Online Learning Center
    • COVID-19 Event Policy
  • Community
    • Arlington Restaurant Week
    • Early Childhood Financial Resiliency Accelerator
    • Coronavirus Resources
    • Coupons
    • Job Board
    • Scholarship Fund
    • About Arlington >
      • Business Resources
      • Map of the Area
      • Visiting Arlington
  • Business Advocacy
    • Public Policy Positions
    • Arlington Advocacy >
      • Budget & Taxes
      • Planning
      • Project Support
      • Economic Development
      • Processes
      • Retail & Signage
      • Transportation
    • Virginia Advocacy >
      • Budget & Taxes
      • Transportation
      • Economic Development
      • Other Topics
    • Recent Advocacy
  • About the Chamber
    • Board of Directors
    • Staff Directory
    • Chamber in the News
    • Strategic Plan
    • FAQs
    • Blog
    • Publications >
      • Arlingtonian Archives
      • Arlingtonian Archives
    • Press Releases
    • Contact Us
  • Membership
    • Membership Benefits
    • Join Now!
    • Chamber Assisted Grand Openings
    • Chamber Member Retirement Program
    • ShopChamber
    • Advertising >
      • Website Ads
      • E-Newsletter Ads
      • Print Ads
    • Arlingtonopoly
    • Committees
    • LeadShare
    • Annual Corporate Sponsors
    • Member Login
  • Business Directory
  • Events
    • Chamber Calendar
    • Community Calendar >
      • Submit a Community Event
    • Networking Events >
      • Chamber 101
      • Breakfast Connection
      • Business After Business
    • Signature Events >
      • Arlington Business Gala
      • Hospitality Awards
      • Legislative Breakfast
      • Arlington Chamber Volunteer Day
      • AWE Women in Business Summit
      • Best Business Awards
      • State of the County & Public Safety Awards
      • Annual Meeting
    • Educational Events
    • Women in Business
    • Travel
    • Online Learning Center
    • COVID-19 Event Policy
  • Community
    • Arlington Restaurant Week
    • Early Childhood Financial Resiliency Accelerator
    • Coronavirus Resources
    • Coupons
    • Job Board
    • Scholarship Fund
    • About Arlington >
      • Business Resources
      • Map of the Area
      • Visiting Arlington
  • Business Advocacy
    • Public Policy Positions
    • Arlington Advocacy >
      • Budget & Taxes
      • Planning
      • Project Support
      • Economic Development
      • Processes
      • Retail & Signage
      • Transportation
    • Virginia Advocacy >
      • Budget & Taxes
      • Transportation
      • Economic Development
      • Other Topics
    • Recent Advocacy
  • About the Chamber
    • Board of Directors
    • Staff Directory
    • Chamber in the News
    • Strategic Plan
    • FAQs
    • Blog
    • Publications >
      • Arlingtonian Archives
      • Arlingtonian Archives
    • Press Releases
    • Contact Us

ChAmber Blog

What Small Businesses Need to Know About CMMC

11/18/2020

0 Comments

 
Picture
Edward Tuorinsky, Managing Principal, DTS

The Cybersecurity Maturity Model Certification (CMMC) requirements are part of the Pentagon’s mandate to protect industrial base networks and controlled unclassified information from cyber attacks. Posed to impact every company within the Defense Department’s supply chain—not just the defense industrial base—CMMC could affect as many as 300,000 contractors, including many small businesses in our area.

​If the thought of the impending CMMC requirement leaves you feeling like there’s a shark in the water, you’re not alone. Many companies in the Defense Industrial Base (DIB) fear losing out on valuable contracts yet feel helplessly afloat.
 
The below Q&A can help clear up some misinformation in the market surrounding CMMC.
 
How did CMMC come about?
The DoD formally announced the CMMC in June 2019, citing a MITRE report from late 2018 that found an overwhelming majority of government contractors were not meeting the requirements of DFARS 252.204-7012, and that less than one percent of companies were compliant with NIST SP 800-171 self-certification.
 
The DoD has worked with private industry to create a 5-level cybersecurity maturity model that will require nearly all DoD contractors to be certified within the next five years. Implementing the practices and achieving maturity levels is especially worrisome for small- and mid-sized businesses (SMB). The CMMC was designed so that an SMB could implement the controls independently. However, in practice, many lack the expertise internally. As a result, many companies turn to cybersecurity consultants.
 
Can you prepare for a CMMC Audit by comparing cybersecurity posture to NIST SP 800-171 controls?
 
The facts: Beware of ads and case studies citing CMMC experience based on NIST SP 800-171 readiness assessments. Conducting NIST SP 800-171 assessments is not the same as conducting CMMC readiness assessments.
 
The CMMC Accreditation Body (AB) has announced that assessors should be using the most current version of the CMMC in their readiness assessments. Additionally, no company is currently authorized to provide an official Maturity Level Assessment. Authorized assessors will be designated by a Certified 3rd Party Assessor Organization (C3PAO) badge.
 
Do DoD Contractors need to be certified by an Accredited Assessor to bid on an RFP?
 
The facts: Maturity Level Certification is not required until award notice. At that time, the contracting officer will need to check SPRS to verify the awardee has the CMMC Maturity Level Certification required by the proposal. The CMMC-AB suggests contractors give themselves six months to get compliant with their desired Maturity Level. This is critical because assessors are being trained to not only look at technical controls and documentation compliance, but also at how long they have been in place. There is an emphasis on maturity in the CMMC. Companies need to show the cybersecurity practices are engrained in their operating culture.
 
It’s important for SMBs to identify what Maturity Level they will need and work toward compliance early.
 
Organizations are using the CMMC logo on their website to suggest they are already aligned with the CMMC Accreditation Body (CMMC-AB) for pre-assessment purposes, is that accurate?
 
The facts: While the CMMC-AB does encourage readiness assessments, the best practice for contractors is to have the work completed by an organization that is a Registered Practitioner Organization (RPO) with Registered Practitioners (RP).
 
As of this writing, the CMMC-AB has not approved any RPO or RP applications. Therefore, using the CMMC logo currently does not indicate any skill level or certification.
 
Does the DoD require CMMC certification starting in FY2021?
 
The facts: If you aren’t bidding on a new contract, your CMMC certification isn’t imperative. The DoD has said the highest level required by any contract in Year 1 would be ML-3. Higher maturity levels are not yet finalized. At least 15 IDIQs/GWACs are scheduled to be released in FY2021 with CMMC requirements. The DoD is very conscious and cautious of how the CMMC ecosystem will function and hopes to avoid bottlenecks.
 
Companies who believe they will need to be certified in 2021 should start the pre-assessment process now, allowing ample time for remediation and reassessments before their official C3PAO audit.
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    The mission of the Arlington Chamber of Commerce is to strengthen businesses and the economic environment for those who work, live and do business in Arlington.
    Picture
    Contribute to the blog!
    Educate the Chamber membership and Arlington business community by writing a post for our blog! To get started download the blog guidelines and blog template. For questions and more information, contact the Communications Manager.

    Archives

    April 2023
    March 2023
    February 2023
    January 2023
    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    February 2016
    January 2016
    December 2015
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    July 2014
    June 2014
    May 2014
    April 2014
    March 2014
    February 2014
    January 2014
    December 2013
    November 2013
    October 2013
    September 2013
    August 2013
    July 2013
    June 2013
    May 2013
    April 2013

    RSS Feed

© Copyright 2023 Arlington Chamber of Commerce. All rights reserved.
2009 14th Street, North  | Suite 100 | Arlington, VA 22201 | Directions
Tel (703) 525-2400 | chamber@arlingtonchamber.org
MemberClicks
Subscribe to our Mailing List
Home | ​Join Now | Site Map