Back to news

January 29, 2020 | International, C4ISR, Security

New cybersecurity standards for contractors could be finalized this week

The first version of the new cybersecurity requirements the Pentagon wants military contractors to follow could be finalized as soon as Jan. 31.

Katie Arrington, chief information security officer for the Office of the Under Secretary of Defense for Acquisition and the point person for the Cybersecurity Maturity Model Certification (CMMC), told an audience Jan. 28 that she will have the requirements by the end of the month.

The CMMC is a tiered cybersecurity framework that grades companies on a scale of one to five. A score of one designates basic hygiene and a five represents advanced hygiene. Arrington said Jan. 28 that the lowest level will become the default for Department of Defense contracts and will include basic tasks such as changing passwords.

Speaking at an event hosted by the law firm Holland and Knight, Arrington said the new standards won't be in effect overnight. The auditors and assessors who will grade companies need training and new contracts will be slowly phased in.

“The likelihood that any awards will be made until 2021 [of the certification] is, I would say, highly unlikely,” she said. She noted that companies are not required to have CMMC certification until the time of award. “You have a full year to get yourselves set, to get yourself in position.”

According to one slide in her presentation, all new contracts will have the requirements in fiscal year 2026. Arrington expects 1,500 companies to be certified by the end of 2021.

The requirements are expected to be free of jargon and overly technical language that can often make military documents befuddling.

“I asked if it could be created on an eighth grade reading level. Why? Because I'm not smart and I owned a small business and I fell prey to this,” she said. “I needed it to be in something that anybody could adapt to. We hear companies all the time say my nephew is doing my cybersecurity. I need your nephew to read what I need him to do.”

Arrington promised that the requirement would not become a simple checklist, because if it does “I've failed. We failed.”

Moreover, she suggested the framework be reevaluated at least once each year because cyber threats will continue to evolve.

https://www.fifthdomain.com/dod/2020/01/28/new-cybersecurity-standards-for-contractors-could-be-finalized-this-week/

On the same subject

  • Slippery slope: MDA boss fights transfer of missile defense system to Army

    August 16, 2019 | International, Land

    Slippery slope: MDA boss fights transfer of missile defense system to Army

    By: Jen Judson HUNTSVILLE, Ala. — The new U.S. Missile Defense Agency director is opposed to the transfer of the Terminal High Altitude Area Defense System, or THAAD, to the Army — something Senate authorizers want to do this year in the fiscal 2020 authorization bill. Talk of transferring THAAD to the Army has been ongoing for roughly a decade. The Army officially operates the system, but the MDA conducts its development and continued modernization. Both MDA and Army leadership have said if Congress were to authorize a transfer, they would not oppose the move as long as the necessary funding is made available and not taken from other portfolios within the service. But there's still a fear that programs transferred to the services is where they go to die, either in their entirety or at least the chance of continued system modernization. For instance, there could be a plan down the road to extend the range of the THAAD interceptor. Historically, at times, when programs are transferred, funding meant to further improve systems has been cannibalized for more pressing, immediate needs within the armed services. “Why would we hand that off to the Army or Air Force, that sort of transfer to a service where it won't be prioritized? They have many other priorities,” MDA Director Vice Adm. Jon Hill told Defense News in an exclusive interview at the Space and Missile Defense Symposium in Huntsville, Alabama. “I don't like organizational experiments on programs that are delivering more fighting capability,” he added. The challenge Before Congress, the military or the MDA consider transferring such a capability, a better definition for “transfer of services” must be ironed out, Hill said. He considers defining this one of his top challenges. “It gets suspicious when we don't have a fully defined term because all it really results in is fracturing of a program during a time where it's most critical to have those programs stable and taking care of the war fighter,” Hill said. “There's been a lot of discussion about the THAAD and the SM-3 [missile] transfer to the services. What does that mean?” The definition of transfer “ranges everything from a full-up transfer of the system over to the service, which assumes that the system is static and how it's designed today is how it's going to be designed forever,” Hill said. If it means transferring operations and sustainment responsibility, and then “put that in the done pile. The Army invests heavily in the operations and sustainment of that. I don't know what more we would want out of them,” he said. The argument MDA is examining whether it is doing enough to support the Army's successful operation and sustainment of the system, he noted, such as whether the service has the right logistics line in place and the right training. A THAAD transfer could also be disruptive to production at a time when THAAD interceptors are in high demand and orders continue to grow. Even if the transfer of THAAD meant the service would responsible for interceptor procurement, the MDA would have to break contracts for the Army to take over, which could result in delayed production, according to Hill. “We know right now, in today's operational environment, we need more,” Hill said. “So that makes no sense to me.” And for Hill, a THAAD transfer is a slippery slope. If the Army took complete control of the batteries, “then there's this discussion, ‘Well, let's include the TPY/2 radar and let's walk it a little bit further and let's take the homeland defense radars that are deployed globally that have a totally different mission.” The resistance to transfer THAAD in its entirety is not a sign of a resistance to transfer where it makes sense, Hill noted. “I often hear that we don't know how to transfer. Well look at the Aegis ships today. Navy procures those ships with ballistic missile defense capability. The Navy has come in and said: ‘Hey, we're going to build a multimission radar to include BMD capability in a SPY-6 [radar],' ” Hill said. “Man, what's wrong with that? That's fantastic.” MDA has also fully transferred the Patriot air and missile defense system to the Army. “Where Patriot is different, is it's a multimission system,” Hill said. “They have air defense as part of the maneuver force. It's sort of like cruise missile defense on a ship. We don't need to take over the Navy's cruise missile defense. ... Patriot is sort of the same thing.” THAAD is part of a wider integrated missile defense system, he added. “THAAD has to stay in MDA ... for the interoperability and integration into the other domains from across the services," Riki Ellison, chairman and founder of the Missile Defense Advocacy Alliance, told Defense News. "THAAD is not an Army-centric weapon system. It should never be deployed as a standoff, alone weapon system.” The Joint Urgent Operational Need out of the Korean theater that calls for the integration of THAAD and Patriot is a prime example, Ellison noted. “MDA is the only one that has cross-domain [Command and Control, Battle Management and Communications] development and operational development as proven with the [Ground-Based Midcourse Defense] System," he said. Rebeccah Heinrichs, a senior fellow at the Hudson Institute, said: “I'm afraid the Army won't fund THAAD if it's their responsibility. We need to free up more money in MDA so it can focus on research and development, so we have a dilemma. Something has to give.” Short of the defense secretary directing the services to fund and support systems like THAAD, Heinrichs said, “they're probably just going to have to stay in MDA. That means we need a much bigger top line in MDA ... to fund the new technologies needed for advanced threats, especially.” The agency is currently advising the Pentagon and Congress on the right plan for where THAAD should live. “That's something that we have to work internally," Hill noted, "and so we need to get our act together on both sides.” https://www.defensenews.com/digital-show-dailies/smd/2019/08/14/mda-director-opposes-transfer-of-terminal-missile-defense-system-to-army/

  • British defense boss commiserates a bit with France over Australia submarine breakup

    September 17, 2021 | International, Naval

    British defense boss commiserates a bit with France over Australia submarine breakup

    '€œI understand Frances's disappointment at the cancellation of the diesel-electric deal,'€ Wallace said at the DSEI defense exhibit in London on Sept. 16.

  • Marine Corps leader eyes drone swarm launched from above, beneath waves

    September 7, 2023 | International, Naval

    Marine Corps leader eyes drone swarm launched from above, beneath waves

    While Marines have yet to test a combo of USV, UUV and attack drones, such a trial is possible in the near future, according to Lt. Gen. Karsten Heckl.

All news