New Security Requirements Coming to DOD Acquisition in 2020

By Lloyd McCoy, Market Intelligence Manager

Starting next summer, anyone selling IT to the Department of Defense will need to be certified by the Cybersecurity Maturity Model Certification (CMMC) in order to compete for contracts.

The CMMC is a set of security standards that will start appearing in RFIs in June 2020 and will apply to all defense acquisitions by September. The CMMCs will represent security maturity levels and will have five levels, each with their associated security controls and processes. Level 1 will likely be like what we consider basic hygiene, with Level 5 describing the very best in security practices. The level needed will depend on the contract and will be used to determine whether a vendor makes the cut. Details on what each of the levels contain are scant right now but expect more information in the coming months as the Department collects public feedback.

Companies cannot self-certify. Starting in early January, DOD will designate third-party certifiers who will evaluate and issue certifications. Fortunately, DOD is willing to include the cost of getting certified in future contracts. While these changes, are far reaching and fast approaching, companies already compliant with NIST 800-171 and DFARs should be well positioned as it is extremely likely the Department will lean heavily on existing cybersecurity controls and requirements. Once CMMC has been implemented, however, companies who do not meet the certification level specified in the contract will not be eligible for an award. It’s important to note that any subcontractors must be certified to at least Level 1 standards. Primes will be responsible for ensuring those certifications.

Those selling to the government must also make sure they are maintaining CMMC standards during the duration of the contract as the Department wants to make sure the vendor can meet CMMC security standards during the duration contract.