Cybersecurity Maturity Model Certification Part 1
Ken Bloch, Director, Maine PTAC

Few things in the Federal contracting realm have caused as much consternation lately as the Cybersecurity Maturity Model Certification (CMMC). In essence, it’s a multi-layer model to mandate contractor cyber security on DoD contracts. The higher the level you qualify at, the more you have to do, but in return the more contracts that you qualify for. It will (eventually) be required to get a DoD contract (and maybe any Federal contract at some point). Its been scaring industry ever since its unveiling over a year ago.

It will take much more than this article to explain it, and we will be presenting future webinars on it, but let it suffice to say that most small businesses will only need to qualify for Level 1, the lowest and least complicated (and expensive) level. I’ve seen one DoD analysis that estimated as many as 70% of DoD’s small business contractors will only need Level 1. The really good news is that Level 1 is “basic cyber hygiene” and is largely things that you should be doing to secure your business in this age. Much of it are things that you may already do, like using passwords and anti-virus software, escorting visitors and locking up your servers. While there will be some expenses, they look to be relatively small(ish) at this point, and DoD says that they will be allowable expenses on your contract.

And CMMC will be rolled out over the next 5 years, starting with the big firms that have serious security needs, the folks that do nuclear and other high-security stuff. It won’t get down to the average small business for a few years, plenty of time to plan and implement the needed steps. So don’t panic.

In the next month’s installment of this I’ll discuss the process to get certified. In the meantime, do NOT sign up with any company that tells you that they can certify you. That is coming, but its not here yet, so save your money.

Questions on CMMC? Please reach out to your local counselor or any of us with your questions or to request assistance. Maine PTAC will be ready to help you. Oh, and stay safe and wash your hands!