Connect with us

Politics

DoD addresses two big challenges to make CMMC a reality

Published

4 months ago

on


The Defense Department feels better than ever about the future of the Cybersecurity Maturity Model Certification program.

DoD is close to solving two big obstacles to get CMMC off the ground more than six years after first introducing the data security program.

After finalizing the first rule related to CMMC last summer, which established the formal program, DoD now believes its path is clear to get the second regulation finalized in the coming months.

Stacy Bostjanick is the DoD’s chief of the Defense Industrial Base Cybersecurity in the CIO’s office.

Stacy Bostjanick, DoD’s chief of the Defense Industrial Base Cybersecurity in the CIO’s office, said the rule to change the Defense Federal Acquisition Regulations (DFARs) is close to going to the Office of Management and Budget’s Office of Information and Regulatory Affairs (OIRA) for final processing.

“They’re [DoD] working on the final edits to get it back to OMB OIRA, so it is moving, and we really expect to keep it close to the original timeline that we expected of later this summer it become in full and published and ready to roll,” Bostjanick said at the Professional Services Council’s Acquisition conference last Thursday.

DoD issued that proposed rule last August. It would do several things including defining controlled unclassified information (CUI) and establish a solicitation provision and prescription for CMMC.

The challenge for DoD came when the Trump administration imposed a 60-day regulatory freeze on its first day in office. While that freeze recently lifted, President Donald Trump also issued an executive order requiring agencies to repeal at least 10 rules, regulations or guidance documents for every new rule. The CMMC DFARS rule got caught up in the regulatory freeze and 10-for-1 exchange requirement.

Bostjanick said she definitely wants to end any rumors that CMMC is going away due to the regulatory freeze.

Pilot shows ways to reduce cost of CMMC

The second big change for DoD is the successful pilot with cloud service providers (CSP) and a managed service provider (MSP) to provide an easier path for companies to meet CMMC requirements.

DoD estimates that there are 220,000 to 300,000 companies in the defense industrial base, roughly 80,000 will need to achieve CMMC level 2, and another 1,500 will need to achieve CMMC level 3.

Additionally, there are only 50 to 60 certified third party assessment organizations (3CPAOs), meaning DoD has to help find a way to deal with a potential backlog.

Bostjanick said the test with the managed service provider showed that this shared service approach could reduce the time and cost for certification.

“We saw one company, I can’t mention the name, but they from zero to 110 controls in two months, and it cost them about $1,300 a seat, and $32,000 for their assessment,” she said. “The same company that got them compliant and got them to their 110 controls can’t do the assessment, so you have to work with another company come and do that assessment. It was two months’ worth of work and not that much money.”

By working with a MSP or CSP, Bostjanick said companies would inherit between 80% and 90% of the controls from the platform.

“The customer responsibility matrix is going to be wildly important for a company to understand and follow because there are certainly things in the NIST SP-800-171 that require you to do work in your spaces. Now, a lot of these MSPs are providing templates and guidance and help to get the company there, but that customer responsibility matrix where you are aware and know exactly your part that you have to play to get to the 110 controls and you know most of the MSPs that are working with you will help hold the hand all the way through,” she said. “I’ve been very heartened by the capabilities that have been born out of this requirement. Industry has definitely risen to the challenge to help us, and they’ve definitely found affordable solutions for small and medium companies.”

Phased rollout coming

The CSPs — including Microsoft, Google, Amazon Web Services and Oracle — have partnered with managed service providers to provide capabilities, mostly through virtual desktops, to contractors.

Bostjanick said one or two of the CSP’s approach protects the data in a way if it gets downloaded to another system, it would automatically move into continuous monitoring mode.

DoD is also working with the industry advisory group the Cyber AB on an online marketplace to list these types of CMMC related services.

“We’re working right now with the Cyber AB on what the website, what would the criteria be for ingesting a company and hosting them on that website? So more to come. But we have seen some wonderful capabilities that have been out there that are definitely low cost, and they provide an environment for companies to operate in,” Bostjanick said.

While vendors already are expected to meet the requirements under NIST 800-171, the CMMC standards are more than a year from being part of a contract award.

Bostjanick said DoD will oversee a phased rollout of the requirements.

“We originally had the first phase of six months where you could continue focusing on that self-attestation, but it would be self-attestation under the CMMC rules, which means you no longer can have a plan of action and milestones (POA&M) that goes out to 2099 before you’d complete it. So now, your POA&Ms will have to be closed within six months, and you’ll have to do your annual affirmation that you are compliant with the NIST 800-171,” she said.

The post DoD addresses two big challenges to make CMMC a reality first appeared on Federal News Network.

Related Topics:
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Politics

President Trump Taps Dr. Ben Carson for New Role — A HUGE Win for America First Agenda

Published

5 hours ago

on

September 25, 2025

By

Dr. Ben Carson is the newest member of the Trump administration.

On Wednesday, former Secretary of the Department of Housing and Urban Development, Ben Carson, was sworn in as the national adviser for nutrition, health, and housing at the U.S. Department of Agriculture.

Agriculture Secretary Brooke Rollins shared that Carson’s role will be to oversee Trump’s new Big Beautiful Bill law, which aims to ensure Americans’ quality of life, from nutrition to stable housing.

After being sworn in, Carson shared, “Today, too many Americans are suffering from the effects of poor nutrition. Through common-sense policymaking, we have an opportunity to give our most vulnerable families the tools they need to flourish.”

Table of Contents

WATCH:

Per USDA:

Today, U.S. Secretary of Agriculture Brooke L. Rollins announced that Dr. Benjamin S. Carson, Sr., M.D., was sworn in as the National Advisor for Nutrition, Health, and Housing at the U.S. Department of Agriculture (USDA).

“There is no one more qualified than Dr. Carson to advise on policies that improve Americans’ everyday quality of life, from nutrition to healthcare quality to ensuring families have access to safe and stable housing,” said Secretary Rollins.

“With six in ten Americans living with at least one chronic disease, and rural communities facing unique challenges with respect to adequate housing, Dr. Carson’s insight and experience is critical. Dr. Carson will be crucial to implementing the rural health investment provisions of the One Big Beautiful Bill and advise on America First polices related to nutrition, health, and housing.

“As the U.S. Secretary of Housing and Urban Development in the first Trump Administration, Dr. Carson worked to expand opportunity and strengthen communities, and we are honored to welcome him to the second Trump Administration to help lead our efforts here at USDA to Make America Healthy Again and ensure rural America continues to prosper.”

“Today, too many Americans are suffering from the effects of poor nutrition. Through common-sense policymaking, we have an opportunity to give our most vulnerable families the tools they need to flourish,” said Dr. Ben Carson. “I am honored to work with Secretary Rollins on these important initiatives to help fulfill President Trump’s vision for a healthier, stronger America.”

On Sunday, Dr. Carson was one of the many speakers at the memorial service of the late TPUSA founder Charlie Kirk.

During the memorial service, Carson highlighted that Kirk was shot at 12:24 p.m. and then continued to share the Bible verse John 12:24, which reads, “Verily, verily, I say unto you, Except a corn of wheat fall into the ground and die, it abideth alone: but if it die, it bringeth forth much fruit.”

WATCH:

The post President Trump Taps Dr. Ben Carson for New Role — A HUGE Win for America First Agenda appeared first on The Gateway Pundit.

Continue Reading

Politics

LEAKED MEMO: Deep State Prosecutors in the Eastern District of Virginia Claim There Isn’t Enough Evidence to Convict Comey Amid Reports of Imminent Indictment

Published

5 hours ago

on

September 25, 2025

By

On Wednesday evening, disgruntled officials in the Eastern District of Virginia leaked contents of a memo explaining why charges should not be brought against James Comey.

As reported earlier, former FBI Director James Comey is expected to be indicted in the Eastern District of Virginia in the next few days.

Comey will reportedly be charged for lying to Congress in a 2020 testimony about whether he authorized leaks to the media.

Officials in the Eastern District of Virginia are still fighting to stop Comey from being charged after Trump fired US Attorney Erik Siebert.

President Trump last week fired Erik Siebert as the US Attorney for the Eastern District of Virginia because he refused to bring charges against Letitia James, Comey, Schiff and others.

On Saturday evening, President Trump announced that he had appointed Lindsey Halligan – his personal attorney who defended him against the Mar-a-Lago raid – as US Attorney for the Eastern District of Virginia.

Now, with just days to go before the statute of limitations runs out to charge Comey for lying during a September 30, 2020 testimony, Lindsey Halligan is reportedly gearing up to indict Comey.

Prosecutors reportedly gave newly sworn-in Halligan a memo defending James Comey and explaining why charges should not brought against the fired FBI Director.

Per MSNBC’s Ken Dilanian:

Two sources familiar with the matter tell me prosecutors in the EDVA US attorney‘s office presented newly sworn US attorney Lindsey Halligan with a memo explaining why charges should not be brought against James Comey, because there isn’t enough evidence to establish probable cause a crime was committed, let alone enough to convince a jury to convict him.

Justice Department guidelines say a case should not be brought unless prosecutors believe it’s more likely than not that they can win a conviction beyond a reasonable doubt.

The post LEAKED MEMO: Deep State Prosecutors in the Eastern District of Virginia Claim There Isn’t Enough Evidence to Convict Comey Amid Reports of Imminent Indictment appeared first on The Gateway Pundit.

Continue Reading

Politics

Nearly 8 in 10 Voters Say the United States is in Political Crisis After the Assassination of Charlie Kirk

Published

5 hours ago

on

September 25, 2025

By

Nearly eight in ten voters believe that the United States is in a political crisis in the wake of the assassination of conservative icon Charlie Kirk.

According to a Quinnipiac University national poll of registered voters released on Wednesday, a massive 93 percent of Democrats, 84 percent of independents, and 60 percent of Republicans said the nation is in a political crisis.

“The Kirk assassination lays bare raw, bipartisan concerns about where the country is headed,” Quinnipiac University Polling Analyst Tim Malloy said of the poll results.

Quinnipiac reports:

Seventy-one percent of voters think politically motivated violence in the United States today is a very serious problem, 22 percent think it is a somewhat serious problem, 3 percent think it is a not so serious problem, and 1 percent think it is not a problem at all.

This is a jump from Quinnipiac University’s June 26 poll when 54 percent thought politically motivated violence in the United States today was a very serious problem, 37 percent thought it was a somewhat serious problem, 6 percent thought it was a not so serious problem, and 2 percent thought it was not a problem at all.

Nearly 6 in 10 voters (58 percent) think it will not be possible to lower the temperature on political rhetoric and speech in the United States, while 34 percent think it will be possible.

Over half, 54 percent, of voters believe the US will see increased political violence over the next few years. Another 27 percent said they think it will stay “about the same,” while just 14 percent believe it will ease.

A 53 percent majority also said they are “pessimistic about freedom of speech being protected in the United States.”

Surprisingly, a 53 percent majority also believes the current system of democracy is not working.

“From a perceived assault on freedom of speech to the fragility of the democracy, a shudder of concern and pessimism rattles a broad swath of the electorate. Nearly 80 percent of registered voters feel they are witnessing a political crisis, seven in ten say political violence is a very serious problem, and a majority say this discord won’t go away anytime soon,” Malloy added.

The vast majority, 82 percent, said the way that people discuss politics is contributing to the violence.

“When asked if political discourse is contributing to violence, a rare meeting of the minds…Republicans, Democrats, and independents in equal numbers say yes, it is,” Malloy said.

The survey was conducted from September 18 to 21 among 1,276 registered voters with a margin of error of +/- 3.3 percentage points.

The post Nearly 8 in 10 Voters Say the United States is in Political Crisis After the Assassination of Charlie Kirk appeared first on The Gateway Pundit.

Continue Reading

Trending