Department of Defense targeting late 2021 for completion of CMMC review
The Department of Defense expects to complete a review of its Cybersecurity Maturity Model Certification program by late 2021, delivering then any required changes to the program to industry.
The review is one of several current initiatives within the Pentagon looking at the cybersecurity program, including a probe by the Government Accountability Office, which is expected to be complete in fall.
“We anticipate the review to be completed in late 2021, at which point the Department will communicate any anticipated changes to the CMMC program to industry and other stakeholders,” a DOD spokesperson told FedScoop.
DOD’s probe of the program was initiated by the deputy secretary of defense in March this year and is focused on ensuring the program achieves its stated goals as effectively as possible, without introducing new barriers to the acquisition process.
Details of the DOD review were first reported by FedScoop in March.
CMMC was launched with the intention of boosting cybersecurity within the U.S. defense industrial base. It hinges on a verification model in which contractors working with the U.S. military must adhere to one of five tiers of cybersecurity controls, depending on the level of sensitive information they handle.
The scheme has attracted criticism from some in industry for introducing new burdens on contractors as it could unfairly penalize smaller companies.
In a letter to Deputy Secretary of Defense Kathleen Hicks last week, three industry groups asked for more communication with industry and support for small businesses trying to comply with the program — and warned that lack of information about CMMC could soon have serious financial implications for the companies they represent.
Hicks reiterated at an event in Pennsylvania at the start of September that the DOD is working with the White House and other agencies including the Small Business Administration to create more opportunities for small businesses to join federal contracting vehicles, saying the department would take “meaningful action” to remove barriers for small contractors.
