The U.S. Department of Defense (DoD), in keeping with a government-wide push to secure supply chains, released details of its new cybersecurity certification model, the Cybersecurity Maturity Model Certification (CMMC),[1] and requested comments on the draft. Public input into the details of the draft were due by Sept. 25.
The CMMC will be mandatory for every one of the more than 300,000 vendors, contractors and suppliers that make up the DoD’s supply chain. The certification is an attempt to streamline and simplify the cybersecurity requirements the DoD imposes on contractors. The draft in its current form consists of five levels of cybersecurity, from “basic” to “advanced”[2] :
-
“Level 1 – Basic. The vendor performs a basic subset of cybersecurity best practices in an ad hoc manner, offering limited resistance against threats.
-
“Level 2 – Intermediate. The vendor implements and documents all universally recognized best practices, offering some resistance against threats.
-
“Level 3 – Good. The vendor covers and actively maintains all security controls required by the National Institute of Standards and Technology’s cybersecurity framework (SP 800-171) for controlled, unclassified information, offering moderate resistance against threats.
-
“Level 4 – Proactive. The vendor regularly reviews and improves security controls and processes. They also rely on automated security controls capable of responding to threats faster than human analysts, offering strong resistance against all but the most advanced threats.
-
“Level 5 – Advanced/Progressive. The vendor continuously improves security processes. It also relies on automated security controls and analytics and offers strong resistance to even the most sophisticated cyber attackers.”
