NIST | The Contracting Education Academy

November 24, 2020 By cs

DoD contractors: Will you be ready for CMMC on Nov. 30?

Responding to fundamental concerns about the cybersecurity of its private sector supply chain, the Department of Defense (DoD) will begin requiring at the end of this month all of its contractors to comply with a complex and demanding new cybersecurity framework.

Starting on November 30, 2020, contractors working for the DoD will need to comply with the long-anticipated Cybersecurity Maturity Model Certification (CMMC). This mandatory requirement will be a go/no-go criterion for eligibility for many DoD contracts.

Issued on September 29, 2020 the interim rule, amends the Defense Federal Acquisition Regulation Supplement (DFARS) to establish the DoD Assessment Methodology for contractor cybersecurity certification and implement the CMMC program.

What is the DoD Assessment Methodology?

The DoD Assessment Methodology requirement was developed to address perceived flaws in the self-assessment process. Currently, under DFARS clause 252.204-7012, contractors must self-certify their compliance with the cybersecurity requirements of NIST SP 800-171 to “covered contractor information systems,” which are generally those that store, process, generate, transmit or access “covered defense information.” Through the interim rule, the DoD Assessment Methodology rates contractor cybersecurity levels as Basic, Medium or High based on the contractor’s implementation of the 110 controls identified under the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-171.

Keep reading this article at: https://www.mondaq.com/unitedstates/security/1003266/defense-department-contractors-will-you-be-ready-for-cmmc-on-november-30

November 18, 2020 By cs

NIST issues updated cybersecurity companion guide

The National Institute of Standards and Technology (NIST) has issued its 5th catalog of security and privacy controls for information systems.

***Click on image above to download publication.***

The purpose of NIST’s publication is to protect organizational operations from a diverse set of threats and risks.

The catalog addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms provided by the controls) and from an assurance perspective (i.e., the measure of confidence in the security or privacy capability provided by the controls). Addressing functionality and assurance helps to ensure that information technology products and the systems that rely on those products are sufficiently trustworthy.

The use of these controls is mandatory for federal information systems in accordance with Office of Management and Budget (OMB) Circular A-130 and the provisions of the Federal Information Security Modernization Act (FISMA), which requires the implementation of minimum controls to protect federal information and information systems.

The latest publication and supplemental materials can be downloaded from: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final.

November 9, 2020 By cs

DoD’s first agreement with accreditation body on contractor cybersecurity nears end

Lead official grapples with the challenge of resourcing a federally funded research and development center to act as a gateway for the Pentagon’s certification program.

The Defense Department is on the cusp of signing a new agreement with the volunteer organization that has been training auditors for its Cybersecurity Maturity Model Certification program, according to DoD’s Katie Arrington, who is leading its implementation.

“They have come light years. We have done two provisional training classes—they’re actually in the middle of the third,” Arrington said during a webinar Tuesday hosted by NeoSystems LLC. “We in the Department of Defense, are, I think today we finalize the statement of work with them. We had a [memorandum of understanding] previously. We’ve been working on a SOW with the no-cost contract to the AB for five years plus.”

The CMMC, as described in an interim rule now up for comment, was designed to replace the current system of DoD taking contractors at their word regarding cybersecurity practices with one that would require third-party verification that such practices are up to snuff.

In March, the DOD signed an MOU with the volunteer group, which is called the CMMC Accreditation Body, or AB. Under that agreement, the AB was responsible for establishing a “CMMC standard” that would guide its certification of companies seeking to do work with the DoD, based on the department’s tiered model of cybersecurity controls.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2020/10/dods-first-agreement-accreditation-body-contractor-cybersecurity-nears-end/169602/

October 26, 2020 By cs

DoD’s CMMC remains stuck in drama, confusion and concern

Industry experts continue to raise serious concerns about the way forward for the Defense Department’s cybersecurity maturity model certification (CMMC) program.

A technology industry representative told reporters on Oct. 20th that the interim rule DoD published in September didn’t offer enough clarity about the certification process, the costs to become certified and whether there will be reciprocity with other cyber standards. Comments on the interim rule are due Nov. 30 and so far more than two dozen people or organizations have submitted analysis.

The official said they are raising these concerns now because DoD is acting with some urgency to get the program rolled out with the release of the interim rule despite repeated attempts by industry and others to raise these problems.

“The interim rule in September addresses some of these concerns and it adds additional information around the requirements around National Institute of Standards and Technology Special publication 800-171, but it doesn’t really address all of them,” said the technology industry representative, who requested anonymity in order to talk candidly about the CMMC program so as not to hurt their relationship with DoD, during the conference call.

Keep reading this article at: https://federalnewsnetwork.com/defense-industry/2020/10/dods-cmmc-remains-stuck-in-drama-confusion-and-concern/

October 23, 2020 By cs

DoD’s interim rule adds a new twist to implementing cyber maturity model

The Defense Department released one of the last major pieces to complete the Cybersecurity Maturity Model Certification (CMMC) program puzzle.

The Pentagon issued an interim rule under the Defense Federal Acquisition Regulations on Sept. 29 to add more clarity around the implementation timeline and around the requirements contractors will have to adhere to over the next five years.

One surprise among observers is the new requirements for vendors working at medium or high security levels to undergo an assessment by the government of how they comply with the standards outlined in Special Publication 800-171 from the National Institute of Standards and Technology.

“The assessment uses a standard scoring methodology, which reflects the net effect of NIST SP 800-171 security requirements not yet implemented by a contractor, and three assessment levels (basic, medium and high), which reflect the depth of the assessment performed and the associated level of confidence in the score resulting from the assessment,” the interim rule stated. “A basic assessment is a self-assessment completed by the contractor, while medium or high assessments are completed by the government. The assessments are completed for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order.”

Keep reading this article at: https://federalnewsnetwork.com/defense-industry/2020/09/dods-interim-rule-adds-a-new-twist-to-implementing-cyber-maturity-model/