CMMC impact on
Small Businesses Seek More Lenient CMMC Audit
Small businesses are seeking to be excused from complying with higher levels of the Department of Defense’s Cybersecurity Maturity Model Certification program.
Jonathan Williams, a partner at the Washington, D.C.-based law firm PilieroMazza, told members of the House Small Business Committee on June 24 that compliance with CMMC requirements beyond level 1 would burden small businesses.
Per Williams’ suggestion, small businesses would only have to meet the lowest level of security controls required for a defense contractor, including implementing multi-factor authentication. Organizations with level 1 certification are authorized to manage federal contract information that is not for public release.
Stringent requirements should be demanded from prime contractors, Williams said. He added that DOD contract clauses should inhibit primes from imposing CMMC requirements beyond the subcontract’s scope of work.
The House hearing also tackled the accreditation of CMMC certified third-party assessment organizations.
Scott Singer, the president of CyberNINES, a consulting company based in Madison, Wisconsin, called for a more lenient assessment of C3PAOs. He recommended that candidate assessors only be evaluated for the first two CMMC levels initially and save Level 3 for later.
The CMMC program reached a critical milestone with the recent authorization of two C3PAOs.
Redspin, a division of CynergisTek, received inaugural C3PAO status on June 9. Kratos received the same designation the following week. Both companies were cleared to audit companies seeking CMMC certification at maturity levels 1 through 3.
Category: Defense and Intelligence
Tags: CMMC cybersecurity Cybersecurity Maturity Model Certification Defense and Intelligence Department of Defense DoD FCW Jonathan Williams Scott Singer