Why Cybersecurity Maturity Model Certification (CMMC)?

Executive Summary:

Cybersecurity Maturity Model Certification (CMMC) is a response to verified trends.

 Data shows:

• Cyber intrusion activity has shifted from primarily targeting Department of Defense (DoD) prime contractors to targeting their suppliers
• Economic losses due to cybercrime are already huge and increasing
• Defense Industrial Base (DIB) companies have largely ignored cybersecurity clauses in their contracts since 2017
• Many DIB companies are filing reports of full compliance that are likely false

Read More:

What’s the big deal about CMMC?

The main clause in CMMC that gets attention is the introduction of third-party certification of compliance with cybersecurity requirements. This applies not only for prime contractors but for all tiers of the supply chain. There are different levels of requirements depending on the sensitivity of the data you handle but all companies that do business with the federal government have at least 17 cyber requirements in contracts now even without CMMC.

 Research indicates only 25% of the cyber requirements in existing contracts have been implemented so many organizations are at risk of losing DoD business if, as planned, certification of the entire bidding team becomes necessary before contracts are awarded.