Back to news

February 3, 2020 | International, Aerospace, Naval, Land, C4ISR, Security

Pentagon finalizes first set of cyber standards for contractors

Mark Pomerleau

The Pentagon has finalized the long anticipated cybersecurity standards contractors will have to follow before winning contracts from the Department of Defense, a new process called the Cybersecurity Maturity Model Certification (CMMC) 1.0.

The model is a tiered cybersecurity framework that grades companies on a scale of one to five based on the level of classification and security that necessary for the work they are performing.

“The government and the contractor community must keep working together to address real and growing cybersecurity threats, and we need a robust response to protect our infrastructure, information, and supply chains,” said David Berteau, president and chief executive of the Professional Services Council, a trade association for federal contractors. “With today's announcement, DoD has achieved a significant milestone.

Here's what industry officials need to know about the version finalized Jan. 31.

Why it was needed

Previously, the Pentagon did not have unified standard for cybersecurity that businesses needed to follow when bidding for contracts. Companies could claim to meet certain industry standards for cybersecurity, but those assertions were not tested by auditors, nor did the standards take into account the type of work a company was bidding to complete. Since then, defense officials have said that cybersecurity is not a one size fits all approach.

In the meantime, adversaries have discovered it is easier to target unsuspecting down tier suppliers, rather than prime contractors.

“Adversaries know that in today's great power competition environment, information and technology are both key cornerstones and attacking a sub-tier supplier is far more appealing than a prime,” Ellen Lord, the under secretary of defense for acquisition and sustainment, told reporters in a briefing at the Pentagon Jan. 31.

Officials have said cyber theft by adversaries costs the United States about $600 billion a year.

What will change?

Contracts will mandate bidders reach a certain level of certification to win specific jobs. For example, if businesses aren't bidding on a contract that has extremely sensitive information, they must only achieve the first level of certification, which involves basic cybersecurity such as changing passwords and running antivirus software. More sensitive programs will require more stringent controls.

Smaller companies down the supply chain will not, however, have to have the same level of certification as primes, said Katie Arrington, chief information security officer for the Office of the Under Secretary of Defense for Acquisition and the point person for the certification.

Another significant change with the new process is the creation of an accreditation board and assessors. The board is an outside entity, separate from DoD, that will be charged with approving assessors to certify companies in the process.

The accreditation body was formed earlier this month and officials are working on identifying and training the assessors, which will be called Certified Third-Party Assessment Organizations (C3PAO).

What's next?

Officials explained Jan. 31 that CMMC will follow a crawl, walk, run approach to ensure companies aren't unprepared for the change. The accreditation board is in the process of training the auditors that will oversee the certificaion. Once the requirements are met, a company's certification is good for 3 years.

In the meantime, DoD plans to release 10 requests for information and 10 requests for proposals that will include the new cyber standards this year. The first solicitation could come as early as June.

Arrington said earlier this week that she expects 1,500 companies to be certified by the end of 2021.

She added that all new contracts starting in fiscal year 2026 will contain the cybersecurity requirements, however, Lord noted that they will not be not retroactive to previous contracts.

https://www.fifthdomain.com/dod/2020/01/31/pentagon-finalizes-first-set-of-cyber-standards-for-contractors/

On the same subject

  • Contract Awards by US Department of Defense - January 13, 2021

    January 14, 2021 | International, Aerospace, Naval, Land, C4ISR, Security

    Contract Awards by US Department of Defense - January 13, 2021

    ARMY Regeneron Pharmaceuticals Inc., Tarrytown, New York, was awarded a $2,625,000,000 firm-fixed-price contract for 1.25 million courses of a monoclonal antibody therapeutic (a combination of casirivimab and imdevimab) for COVID-19. Bids were solicited via the internet with one received. Work will be performed in Tarrytown, New York, with an estimated completion date of Jan. 11, 2022. Fiscal 2022 research, development, test and evaluation (Army) funds in the amount of $2,625,000,000 were obligated at the time of the award. U.S. Army Contracting Command, Newark, New Jersey, is the contracting activity (W15QKN-21-C-0014). (Awarded Jan. 12, 2021) International Business Machines Corp., Bethesda, Maryland, was awarded a $17,758,596 modification (P00094) to contract W52P1J-17-C-0008 for services and solutions to support and maintain the General Fund Enterprise Business System Financial System Army-wide. Work will be performed in Bethesda, Maryland, with an estimated completion date of Jan. 15, 2022. Fiscal 2021 operation and maintenance (Army) funds; and 2020 and 2021 research, development, test and evaluation (Army) funds in the amount of $17,758,596 were obligated at the time of the award. U.S. Army Contracting Command, Rock Island Arsenal, Illinois, is the contracting activity. NAVY Data Link Solutions LLC, Cedar Rapids, Iowa (N00039-21-A-1001); and DRS Laurel Technologies Partnership, Johnstown, Pennsylvania (N00039-21-A-1002), are each awarded $150,000,000 firm-fixed-price blanket purchase agreements (BPAs) for electronic equipment cabinets. These BPAs cover the production of up to 150 units per contractor along with the associated program management, testing and logistics support to deliver the units. Units will be manufactured in Cedar Rapids, Iowa; and Johnstown, Pennsylvania, with an expected completion date of January 2023. The total potential value of these BPAs is $150,000,000 per vendor. The total length of the ordering period is 24 months. Fiscal 2021 other procurement (Navy) funds will be obligated on a delivery order level issued under the BPA at the time of placement of individual delivery calls. These BPAs were negotiated using the procedures defined under Federal Acquisition Regulation 13.5 for individual orders less than $15,000,000. The Naval Information Warfare Systems Command, San Diego, California, is the contracting activity. General Electric Aviation, Lynn, Massachusetts, is awarded a $101,470,782 firm-fixed-price, cost-plus-fixed-fee modification (P00015) to previously awarded contract N00019-18-C-1007. This modification procures 21 T408-GE-400 turboshaft engines and associated engine, programmatic and logistics services in support of CH-53K Lot Five low rate initial production aircraft. Work will be performed in Lynn, Massachusetts, and is expected to be completed in December 2024. Fiscal 2021 aircraft procurement (Navy) funds in the amount $101,470,782 will be obligated at time of award, none of which will expire at the end of the current fiscal year. The Naval Air Systems Command, Patuxent River, Maryland, is the contracting activity. MN-BMCD SE JV, Tampa, Florida, is awarded a maximum-value $60,000,000 firm-fixed-price, indefinite-delivery/indefinite-quantity, architect-engineering contract for professional architectural and engineering services in support of waterfront projects in the Naval Facilities Engineering Systems Command (NAVFAC) Southeast area of responsibility (AOR). The work to be performed provides for preparation of professional architectural and engineering services for preparation of design-bid-build documents and design-build requests for proposals for various project types in support of waterfront and marine facilities at Department of Defense (DOD) and non-DOD activities in the NAVFAC Southeast AOR. Future task orders will be primarily funded by operation and maintenance (Navy) and military construction (Navy) funds. Work will be performed at various Navy and Marine Corps installations in the NAVFAC Southeast AOR including, but not limited to Florida (30%); Georgia (30%); Andros Island, Bahamas (10%); Guantanamo Bay, Cuba (10%); South Carolina (5%); Louisiana (5%); Mississippi (5%); and Texas (5%), and is expected to be completed by February 2026. An initial task order to conduct a site engineering investigation and concept design workshop for P-021 lighterage wharf and lift-launch pier at Marine Corps Support Facility Blount Island, Florida, is included with the award and is expected to be completed by April 2021. Fiscal 2021 military construction (Navy) funds in the amount of $202,780 will be obligated at time of award and will not expire at the end of the current fiscal year. This contract was competitively procured via the Navy Electronic Commerce Online website, with two proposals received. The Naval Facilities Engineering Systems Command, Southeast, Jacksonville, Florida, is the contracting activity (N69450-21-D-0002). Chatmon-VJR JV LLC,* La Place, Louisiana, is awarded a maximum-value $49,000,000 indefinite-delivery/indefinite-quantity contract for roofing projects at various military installations in the metropolitan San Diego, California, area, including Naval Base Coronado, Naval Base Point Loma, Naval Base San Diego, and Marine Corps Air Station Miramar. No task orders are being issued at this time. The work to be performed is for repair, removal and replacement of roofing systems at various military installations in the metro San Diego area. Projects may include, but are not limited to, roofing services with minimal design requirements for new minor construction, facility repair, rehabilitation and alterations for a broad range of renovation and construction work. Future task orders will be primarily funded by operation and maintenance (Navy) funds. Work will be performed in San Diego, California, and is expected to completed by January 2026. Fiscal 2021 operation and maintenance (Navy) funds in the amount of $5,000 will be obligated at time of award and will expire at the end of the current fiscal year. This contract was competitively procured via the Navy Electronic Commerce Online website, with seven proposals received. The Naval Facilities Engineering Systems Command, Southwest, San Diego, California, is the contracting activity (N62473-21-D-2601). Essex Electro Engineers Inc.,* Schaumburg, Illinois, is awarded a $46,638,225 firm-fixed-price indefinite-delivery/indefinite-quantity contract. This contract provides for the production and delivery of up to a maximum quantity of 575 land-based mobile electric power plant units to provide 120KVA 115 VAC 400 Hz/270VDC/28VDC electric power to support general aircraft maintenance for all Navy aircraft platforms. Work will be performed in Schaumburg, Illinois, and is expected to be completed in January 2027. No funds will be obligated at the time of award; funds will be obligated on individual orders as they are issued. This contract was competitively procured as a small business set-aside and five offers were received. The Naval Air Warfare Center, Aircraft Division, Lakehurst, New Jersey, is the contracting activity (N68335-21-D-0049). Team Corp., Burlington, Washington, is awarded a $26,417,062 firm-fixed-price contract. This contract provides 24 environmental testing systems that simulate the effects of climatic, induced thermal, dynamic and loads environments. The environmental testing systems support the development, design, environmental qualification, airworthiness, product improvement and failure investigations of Department of Defense weapon and target systems. The scope of this requirement is to design, manufacture, test and install the environmental testing systems. Support services include lead system integration, building and laboratory design specifications support, project management, equipment installation and training. Work will be performed in Burlington, Washington (50%); and China Lake, California (50%), and is expected to be completed in January 2024. Fiscal 2020 other procurement (Navy) funds in the amount of $26,417,062 will be obligated at time of award, none of which will expire at the end of the current fiscal year. This contract was not competitively procured pursuant to Federal Acquisition Regulation 6.302-1. The Naval Air Warfare Center, Weapons Division, Point Mugu, California, is the contracting activity (N68936-21-C-0032). DEFENSE LOGISTICS AGENCY Puerto Rico Apparel Manufacturing Corp.,** Mayaguez, Puerto Rico, has been awarded a maximum $12,775,524 modification (P00026) exercising the second one-year option period of one-year base contract SPE1C1-19-D-1127 with four one-year option periods for various types of coats and trousers. This is a firm-fixed-price, indefinite-delivery/indefinite-quantity contract. Location of performance is Puerto Rico, with a Jan. 15, 2022, ordering period end date. Using military services are Army and Air Force. Type of appropriation is fiscal 2021 through 2022 defense working capital funds. The contracting activity is the Defense Logistics Agency Troop Support, Philadelphia, Pennsylvania. San Antonio Light House for the Blind,*** San Antonio, Texas, has been awarded a maximum $8,295,000 firm-fixed price, indefinite-delivery/indefinite-quantity contract for trousers. This is a one-year base contract with two one-year option periods. Location of performance is Texas, with a Jan. 13, 2022, ordering period end date. Using military services are Army and Air Force. Type of appropriation is fiscal 2021 through 2022 defense working capital funds. The contracting activity is the Defense Logistics Agency Troop Support, Philadelphia, Pennsylvania (SPE1C1-21-D-B101). *Small business **Economically disadvantaged woman-owned small business in historically underutilized business zones ***Mandatory source https://www.defense.gov/Newsroom/Contracts/Contract/Article/2471330/source/GovDelivery/

  • BAE, Iveco join forces to market amphibious combat vehicle in Europe

    May 19, 2023 | International, Land

    BAE, Iveco join forces to market amphibious combat vehicle in Europe

    The companies showed the vehicle for the first time in Europe during the FEINDEF defense exhibition in Madrid, eying a new sales opportunity in Spain.

  • Biden admin moving ahead with UAE F-35, drone sales for now

    April 15, 2021 | International, Aerospace

    Biden admin moving ahead with UAE F-35, drone sales for now

    A nonprofit is expected to file a legal challenge in an attempt to cancel the sale, started under the Trump administration.

All news