Connect with us

Politics

How CMMC is addressing years of systemic failures in protecting sensitive data

Published

3 weeks ago

on

What: Evolution of securing CUI and development of CMMC
When: The CMMC final rule went into effect in December 2024 and will start appearing in contracts at the end of 2025.
Why it matters: The Defense Department is on the cusp of implementing the Cybersecurity Maturity Model Certification (CMMC) program after years of government efforts to fix systemic weaknesses in how the federal government and its contractors handle sensitive information.
To celebrate our 25th anniversary in 2025, we’re spotlighting 25 pivotal moments that reshaped the way the government operates. Visit our anniversary page each week as we look back on these defining moments.

The Defense Department is on the cusp of implementing the Cybersecurity Maturity Model Certification (CMMC) program after years of government efforts to fix systemic weaknesses in how the federal government and its contractors handle sensitive information.

The origin story of CMMC goes back more than 20 years — to the post-9/11 series of reforms like the Homeland Security Act of 2002 and the Intelligence Reform and Terrorism Prevention Act of 2004, which triggered a governmentwide effort to improve the information sharing environment of not just classified but also sensitive information. Spurred by the 9/11 Commission Report, which found deep flaws in how government agencies shared critical intelligence, the federal government kicked off a concerted effort to better identify and protect sensitive unclassified information.

The term controlled unclassified information (CUI) emerged during this period, as federal agencies started to better understand and explain the concept of unclassified data that still needed protection.

In 2010, President Barack Obama issued Executive Order 13556, which directed the National Archives and Records Administration to implement uniform program for managing controlled unclassified information. 

“At present, executive departments and agencies employ ad hoc, agency-specific policies, procedures and markings to safeguard and control this information, such as information that involves privacy, security, proprietary business interests and law enforcement investigations. This inefficient, confusing patchwork has resulted in inconsistent marking and safeguarding of documents, led to unclear or unnecessarily restrictive dissemination policies and created impediments to authorized information sharing. The fact that these agency-specific policies are often hidden from public view has only aggravated these issues,” the executive order stated.

NARA’s role included establishing a single governmentwide CUI registry, which standardized the way all federal agencies handled CUI. But it was not until 2016 that the federal government formally codified the CUI program through 32 CFR Part 2002, establishing baseline safeguards for how agencies protect and manage the information. 

Then there was another effort unfolding in parallel — the federal government’s shift to a standardized, risk-based approach to information security. The Federal Information Security Modernization Act (FISMA), first enacted in 2002 and updated in December 2014, defined a framework for how agencies assess and mitigate cybersecurity risk.

As a result, the National Institute of Standards and Technology (NIST) developed a series of foundational documents — Federal Information Processing Standard (FIPS) 199 provided a framework for categorizing information systems based on their impact on organizational operations; FIPS 200 outlined the baseline security requirements for agencies’ information systems; and NIST Special Publication 800-53 provided a catalog of security and privacy controls for information systems.

Together, these documents helped federal agencies to manage information security in a more coherent manner. 

Meanwhile, a series of cyber incidents in the early 2000s prompted the Pentagon to launch the Defense Industrial Base Cybersecurity Program in 2007.  And by 2013, the DoD introduced the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 — the oldest of four clauses in the DFARS 70 series —  requiring contractors to protect certain sensitive data and implement a set of cybersecurity controls.

Then, on April 15, 2015, IT staffers noticed a strange signal coming from the Office of Personnel Management. The event turned out to be the largest and most significant data breach in the history of the federal government. The breach fast-tracked the publication of a long-in-development set of requirements — NIST SP 800-171 — a streamlined set of 110 controls tailored to protect CUI in non-federal systems. 

In 2016, DoD updated DFARS 7012 to require contractors to implement all 110 controls from NIST 800-171, but compliance was largely self-reported, leaving major gaps in implementation and enforcement of critical cybersecurity practices.

Subsequent audits by the DoD Inspector General found widespread noncompliance, all the while foreign adversaries continued to exploit weak links in the defense supply chain. 

“We saw the increase in cyber espionage, even some of the large contractors having security incidents regarding foreign adversaries accessing DIB information. You look at critical infrastructure, the estimates are somewhere between 400,000 to 700,000 companies. You combine that with these small, five person companies in the manufacturing sector, or just lower down on the value chain that really were a weak link in the supply chain. They were an opportunity for these foreign adversaries to infiltrate the supply chain and gather data and things that really can cause harm. And I think DoD recognized that their enforcement mechanisms, the FAR clauses, weren’t as effective as they needed to be,” Katie Stewart, who served as a senior member of the technical staff with the Software Engineering Institute of Carnegie Mellon University, told Federal News Network. 

Then Congress took notice.

Table of Contents

Enter CMMC

The 2020 National Defense Authorization Act directed the Defense Department to develop a framework, now known as CMMC, for verifying contractor cybersecurity are compliant with the Defense Department’s cybersecurity requirements.

Initially released as version 1.0 in 2020, CMMC introduced five levels of cybersecurity maturity, ranging from basic hygiene to advanced cybersecurity practices. The documentation and process requirements mirrored industry standards like CMMI.

“When CMMC 1.0 and the five levels were established, it really had this idea of how we can give industry a tool for improvement. It wasn’t just going to be we are going to grade you and you pass or you fail. It was, ‘Start at level one, move to level two when you’ve accomplished level one. That introduced a lot of challenges and feedback, rightfully so,” Stewart said.

Small and medium-sized businesses found the five-level model to be overly complex and too costly to implement. Plus, businesses argued the model was too burdensome and rushed, especially since it wasn’t yet tied to an official rule. 

In 2021, the Defense Department unveiled CMMC 2.0, a more streamlined version of the original framework that reduced the number of levels from five to three and aligned more closely with NIST 800-171. It also removed many of the documentation requirements from the lower levels, allowing self-assessments for Level 1 certification and some Level 2 cases and reserving third-party assessments for contracts involving sensitive CUI.

“The CMMC 1.0 had a lot more documentation requirements that are implied in 2.0 but are not spelled out explicitly. Another kind of challenge was, and I think is one of the hardest things about this model and the development of this model, is that it’s a one-size-fits-all. I think there was value in the 1.0 model structure, but I think in reality the way that the model is today is probably the correct format and it makes more sense that way,” Stewart said.

CMMC applies to any organization supporting the Defense Department and working with Federal Contract Information, CUI, Covered Defense Information, Controlled Technical Information, or export-controlled data.

DoD estimates that there are 220,000 to 300,000 companies in the defense industrial base, and roughly 80,000 will need to achieve a CMMC level 2 certification, and another 1,500 will need to achieve CMMC level 3.

The CMMC final rule went into effect in December 2024, but implementation of the program has not begun since the follow-on rule to update contractual requirements in the DFARS is still in the rulemaking process. In the meantime, DoD has encouraged contractors to start preparing for eventual assessments.

Looking ahead

Stewart said CMMC is here to stay, and that federal civilian agencies will likely follow suit.

“Tying it to 801-171 is good and bad. In a way the program kind of has to wait on this as they make updates. CMMC will always kind of take a little bit of time to kind of adopt the new requirements as they come out. Will it be that way forever? I don’t know. There may be a time where the role of NIST is different in this, but that’s just pure speculation. I think one of the biggest signals that we’ve seen is the CUI rule that is in draft right for the federal civilian space,” Stewart said.

“I have always kind of said that federal civilians are waiting to see how DoD does with CMMC before they kind of put their foot in the water. CUI is not a DoD designation, it’s a NARA designation, it’s governmentwide. So there’s no reason why you’re not going to see other organizations kind of follow suit behind DoD. What I hope is that there is some sort of reciprocity in place, right, that we’re not reinventing the wheel. I’m hoping there’s some consolidation and some efficiency gained for organizations that do work and in both spaces,” she added.

The post How CMMC is addressing years of systemic failures in protecting sensitive data first appeared on Federal News Network.

Related Topics:
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Politics

Gov. JB Pritzker Brokers Deal to Host Roughly 30 Texas Democrats in Chicago for Week-Long Plot Against GOP Redistricting Plan

Published

5 hours ago

on

August 4, 2025

By

Credit: Staff Sgt. Aaron Rodriguez (Joint Force Headquarters – Illinois National Guard Public Affairs)

Illinois Governor JB Pritzker is now playing host to roughly 30 rogue Texas Democrats who fled the Lone Star State to block a mid-decade redistricting vote backed by President Donald Trump and the Republican legislature.

The Texas Democrats, once again resorting to legislative cowardice, broke quorum just before a scheduled special session that would have cemented a new congressional map, one expected to create five new GOP-leaning seats.

In their desperate attempt to stop the vote, these runaway lawmakers fled across state lines to Chicago, where they are being sheltered and advised by none other than far-left Governor Pritzker himself, according to NBC.

This marks the second time in recent years that Texas Democrats have pulled this unconstitutional stunt. They tried the same tactic in 2021—and failed.

In response, Texas Attorney General Ken Paxton blasted the lawmakers, saying: “Democrats in the Texas House who try and run away like cowards should be found, arrested, and brought back to the Capitol immediately. We should use every tool at our disposal to hunt down those who think they are above the law.”

Last month, Paxton issued a stern warning, vowing to arrest any Democrats who attempted to play political games.

“If Democrats ignore their duty to their constituents by breaking quorum, they should be found and arrested no matter where they go. The people of Texas elected them to do a job, not run away and hide like cowards. Lawmakers must answer the special session call and pass the important priorities that the Governor has put forward.

My office stands ready to assist local, state, and federal authorities in hunting down and compelling the attendance of anyone who abandons their office and their constituents for cheap political theater.”

Now, far-left Illinois Governor JB Pritzker has brokered a deal to host 30 Texas Democrats in Chicago in a last-ditch attempt to sabotage a redistricting plan backed by President Donald Trump and Texas Republicans.

These rogue Texas lawmakers fled the Lone Star State like cowards, deliberately breaking quorum to grind legislative business to a halt.

NBC reported:

The roughly 30 Democrats are expected to stay for the week in a plan brokered with Illinois Gov. JB Pritzker, who had met with the Texas caucus late last month and has directed staff to provide logistical support for their stay. A news conference with the governor and Texas Democrats is expected later Sunday.

“We’re leaving Texas to fight for Texans,” Texas House Democratic Caucus Chair Gene Wu said in a statement. “We will not allow disaster relief to be held hostage to a Trump gerrymander. We’re not walking out on our responsibilities; we’re walking out on a rigged system that refuses to listen to the people we represent. As of today, this corrupt special session is over.”

[…]

Politically, the move puts Pritzker at the center of a high-profile national fight. The governor, who is running for his third term in office, is also widely viewed as a 2028 presidential contender. He has implored Democrats to resist Trump’s agenda.

The origins of Pritzker’s involvement began when the governor gave a keynote address to Oklahoma Democrats in June. Pritzker met privately in a “robust” meeting with the party chair to talk about the Texas redistricting, according to a person close to the governor. When Pritzker later met with Texas Democrats, he assured them they could come to his state and find support, including finding hotels, meeting spaces and other logistical assistance.

The Texas Democrats, however, face the risk of a $500-a-day fine and even possible arrest for fleeing the state. The Republican-controlled Legislature approved the measure in 2023, two years after state Democrats left the state for three weeks to block an elections bill from progressing.

“Democrats have got to stand up at this point and tell every individual in this nation, ‘This is not normal. This is not democracy,’” Democratic state Rep. Ann Johnson told NBC News on Saturday.

The post Gov. JB Pritzker Brokers Deal to Host Roughly 30 Texas Democrats in Chicago for Week-Long Plot Against GOP Redistricting Plan appeared first on The Gateway Pundit.

Continue Reading

Politics

Sydney Sweeney Is Revealed to be Registered Republican Amid Woke Backlash Over American Eagle’s ‘Good Jeans’ Ad

Published

5 hours ago

on

August 4, 2025

By

In a stunning revelation that’s sure to infuriate the radical left even more, bombshell actress Sydney Sweeney has been outed as a registered Republican in Florida, just as she’s facing absurd backlash over a harmless American Eagle jeans advertisement.

The 27-year-old “Euphoria” star, known for her roles in hit shows and films, registered with the GOP in Monroe County in June 2024, according to public voter records viewed by The Gateway Pundit.

This comes at a time when left-wing activists are desperately trying to cancel her for an ad that playfully puns on “great jeans” and “good genes,” twisting it into some far-fetched eugenics conspiracy.

The controversy erupted last week when American Eagle launched its fall campaign featuring Sweeney. In the ad, the blonde beauty struts in denim while narrating about her family heritage: “My parents always said I got good genes… Great jeans look good on everyone.”

The ad’s slogan is a clever play on words, tying into the brand’s jeans line and celebrating confidence and personal style. But in today’s hyper-woke climate, nothing innocent escapes the outrage mob. Critics on social media, particularly from progressive circles, accused the ad of promoting “white supremacy” and eugenics, claiming the “genes” reference evokes Nazi-era ideals of genetic superiority, simply because Sweeney is white, attractive, and unapologetically feminine.

American Eagle fired back against the nonsense, issuing a statement that read, in part, “Her jeans. Her story. We’ll continue to celebrate how everyone wears their AE jeans with confidence, their way.”

This isn’t the first time Sweeney has faced scrutiny for not toeing the Hollywood leftist line. Rumors of her conservative leanings have swirled for years, fueled by photos from a family gathering where people were seen wearing red MAGA hats. Sweeney never commented on the controversy.

Sweeney is no longer just a talented actress, she’s emerging as a symbol of resistance against cancel culture.

The post Sydney Sweeney Is Revealed to be Registered Republican Amid Woke Backlash Over American Eagle’s ‘Good Jeans’ Ad appeared first on The Gateway Pundit.

Continue Reading

Politics

Motorcyclist Gets Taught a Hard Lesson After Performing Dangerous Stunts in Front of Police Officers (VIDEO)

Published

5 hours ago

on

August 4, 2025

By

Credit: Pueblo Police Department

A motorcyclist got taught a hard lesson after deciding to perform stupid stunts while driving in front of police.

As KKTV reported on Thursday, a person in Pueblo, Colorado got busted by police last month after officers witnessed a series of reckless moves by him and two of his cronies.

These motorcyclists blocked traffic with their stunts, causing several community members to call the cops and complain.

As the video below shows, motorcyclists perform sets of wheelies and stand up on the seat, endangering themselves and others on the road.

Once the motorcyclists reach a stoplight, the Pueblo police spring into action. They gang tackle the motorcyclist closest to them, and the other two drivers speed off.

He is then put into handcuffs.

WATCH:

One of the officers angrily explains to the motorcyclist that he has a whole dashcam of him doing stupid things while driving on the road, endangering everybody.

Then the idiot receives news that he probably considers worse than an arrest: the police officer tells him they will tow his bike and put a hold on it for a nuisance.

“Oh no, please don’t do that,” he whines.

The policeman further explains that the bike will now go into storage, and the biker must pay the tow fee every day for six months.

“No, dude. Please don’t do this. It’s a minibike, I hardly ever ride that thing,” he whimpers.

The cop closes by telling the motorcyclist they are not trying to make his life harder, but that he put everyone in danger. Thus, he needs to suffer the consequences for his actions.

The post Motorcyclist Gets Taught a Hard Lesson After Performing Dangerous Stunts in Front of Police Officers (VIDEO) appeared first on The Gateway Pundit.

Continue Reading

Trending