CMMC-AB Posts RFP for Continuous Monitoring Solution

The Cybersecurity Maturity Model Certification Accreditation Body is seeking proposals for a continuous monitoring solution in the form of a portal that would address gaps between the triennial assessments of defense contractors. As specified in a request for proposals, the solution will be used to conduct pre-assessment background research and monitor companies between formal assessments.

Interested sources must ensure that certified third-party assessment organizations would receive automatic notifications should any of the companies under their supervision receive a to-be-determined security score decrease, Nextgov reported.

The solution is expected to have varying degrees of accessibility so as to limit the Department of Defense staff from having read-only access to the portal. Authorized DoD staff should only be able to “search for and view information on any company in the database and to access aggregated metrics from across all monitored companies and defined subsets thereof,” according to the RFP.

The CMMC-AB also requests for the solution to be deployable on a global scale to expand its application to multinational companies and subcontractors based outside the U.S.

In addition to creating a portal that meets the aforementioned requirements, the contractor selected for the effort must accept and secure intellectual property belonging to the CMMC-AB and the DoD.

Interested sources have until May 1 to submit their responses to the RFP.

Katie Arrington, chief information security officer for the assistant secretary for defense acquisition, mentioned the RFP during a recent webinar, where she also addressed questions about the DOD’s efforts to adapt to CMMC delays caused by the coronavirus.

Parts of the training and audits are in-person, Arrington said, adding that some CMMC personnel are currently advised to stay at home and minimize in-person meetings.