3 février 2020 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

Pentagon finalizes first set of cyber standards for contractors

Mark Pomerleau

The Pentagon has finalized the long anticipated cybersecurity standards contractors will have to follow before winning contracts from the Department of Defense, a new process called the Cybersecurity Maturity Model Certification (CMMC) 1.0.

The model is a tiered cybersecurity framework that grades companies on a scale of one to five based on the level of classification and security that necessary for the work they are performing.

“The government and the contractor community must keep working together to address real and growing cybersecurity threats, and we need a robust response to protect our infrastructure, information, and supply chains,” said David Berteau, president and chief executive of the Professional Services Council, a trade association for federal contractors. “With today's announcement, DoD has achieved a significant milestone.

Here's what industry officials need to know about the version finalized Jan. 31.

Why it was needed

Previously, the Pentagon did not have unified standard for cybersecurity that businesses needed to follow when bidding for contracts. Companies could claim to meet certain industry standards for cybersecurity, but those assertions were not tested by auditors, nor did the standards take into account the type of work a company was bidding to complete. Since then, defense officials have said that cybersecurity is not a one size fits all approach.

In the meantime, adversaries have discovered it is easier to target unsuspecting down tier suppliers, rather than prime contractors.

“Adversaries know that in today's great power competition environment, information and technology are both key cornerstones and attacking a sub-tier supplier is far more appealing than a prime,” Ellen Lord, the under secretary of defense for acquisition and sustainment, told reporters in a briefing at the Pentagon Jan. 31.

Officials have said cyber theft by adversaries costs the United States about $600 billion a year.

What will change?

Contracts will mandate bidders reach a certain level of certification to win specific jobs. For example, if businesses aren't bidding on a contract that has extremely sensitive information, they must only achieve the first level of certification, which involves basic cybersecurity such as changing passwords and running antivirus software. More sensitive programs will require more stringent controls.

Smaller companies down the supply chain will not, however, have to have the same level of certification as primes, said Katie Arrington, chief information security officer for the Office of the Under Secretary of Defense for Acquisition and the point person for the certification.

Another significant change with the new process is the creation of an accreditation board and assessors. The board is an outside entity, separate from DoD, that will be charged with approving assessors to certify companies in the process.

The accreditation body was formed earlier this month and officials are working on identifying and training the assessors, which will be called Certified Third-Party Assessment Organizations (C3PAO).

What's next?

Officials explained Jan. 31 that CMMC will follow a crawl, walk, run approach to ensure companies aren't unprepared for the change. The accreditation board is in the process of training the auditors that will oversee the certificaion. Once the requirements are met, a company's certification is good for 3 years.

In the meantime, DoD plans to release 10 requests for information and 10 requests for proposals that will include the new cyber standards this year. The first solicitation could come as early as June.

Arrington said earlier this week that she expects 1,500 companies to be certified by the end of 2021.

She added that all new contracts starting in fiscal year 2026 will contain the cybersecurity requirements, however, Lord noted that they will not be not retroactive to previous contracts.

https://www.fifthdomain.com/dod/2020/01/31/pentagon-finalizes-first-set-of-cyber-standards-for-contractors/

Sur le même sujet

  • How new prototyping dollars will help Army network modernization

    22 juillet 2020 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

    How new prototyping dollars will help Army network modernization

    Andrew Eversden ABERDEEN PROVING GROUND, Md. — The U.S. Army is moving forward on a number of projects to bolster its tactical network, thanks to a new pool of money dedicated to prototyping and maturing emerging technology. Additions to the Army's tactical network will come every two years as part of modernization efforts called capability sets. Previously, prototypes of emerging technology would fall into the “valley of death,” where technology projects that didn't have enough funding to transition into programs of record would die, said Maj. Gen. Peter Gallagher, director of the Army's Network Cross-Functional Team. The CFT received nearly $30 million to support prototyping efforts for science and technology efforts as well as industry work in fiscal 2020, according to Justine Ruggio, communications director for the CFT. According to a May news release from Army Program Executive Office Command, Control, Communications-Tactical, the Army network modernization team has identified eight “promising,” Army-led science and technology efforts as well as six industry-led prototyping projects. The Army is particularly interested in low-Earth orbit satellite constellations to improve bandwidth and reduce latency for Capability Set '23 and Capability Set '25, said Michael Breckenridge, acting associate director for the Office of Science and Technology. His office falls under the purview of the Army's Combat Capabilities Development Command C5ISR (Command, Control, Communication, Computers, Cyber, Surveillance, and Reconnaissance) Center. The S&T team is researching how the service can move and secure traffic through these constellations. “While those are very much in their infancy as far as the commercial LEO constellations coming together, we're already working with those vendors to try and get satellite time to be able to do experimentation to understand the capability and how do we shape, then, future investments in that space,” Breckenridge said. The Network CFT is also excited about the survivability and mobility of the Army's command posts, said Donald Coulter, senior S&T adviser for the CFT. It's also focused on spectrum obfuscation capabilities as well as an identity management project that explores new ways of verifying users' identities (for example, through wearables) to ensure the security of Army systems if equipment falls into enemy hands, he added. The S&T community and the CFT are also working on a secure communications link between manned and unmanned fighting vehicles, something that may be used for other parts of the network, Breckenridge said. For example, the C5ISR Center is also experimenting with that link for distributed command post nodes and between command post links, he noted. Previously, a lack of funds made it difficult to create an “entire road map to field” prototypes, he added, and teamwork between the network team and S&T community suffered. But with the newly allocated funds, the S&T community and the Network CFT are able to work more closely. The dollars have been “the key to have the groups from across all those different communities come together focusing on what specifically we need to take viable concepts and promising concepts from idea to demonstration to real ... tangible and robust thing[s] that we can acquire and field,” said Coulter. With the prototyping dollars now in place, the CFT is expected to have an easier time developing technologies for the service's network modernization plan, driven by capability sets. Capability Set '21, which completed critical design review in April, is focused on addressing immediate gaps in the Army's network with currently available technologies. The Army has begun buying those new network tools, which focus on smaller, lighter, faster communication systems for soldiers, and will begin fielding the technology in fiscal 2021. Meanwhile, Capability Set '23, which has preliminary design review scheduled for April next year, is focused on high-capacity, low-latency communications that aren't mature enough today, Gallagher said at the C4ISRNET Conference in May. Future capability sets will include emerging technologies that improve network resiliency. For example, after Capability Set '23, soldiers will have more bandwidth at the tactical edge, allowing for the increased adoption of machine learning and other emerging technologies. The Army is also in the planning stages of Capability Set '25. Even as the Army identifies key technologies for future capability sets, it must work within the constraints of budgets, meaning that the Network CFT and the C5ISR Center have to work together to identify S&T priorities. Coulter said the “key thing” that the CFT does is prioritize its portfolio and provide guidance on critical capability gaps. Breckenridge said the S&T community brings an understanding of adversarial threats to the network and what investments can be made to mitigate those threats to inform the CFT's prioritization. “One of the key things that S&T community does is ... identify those opportunities,” Coulter said. “So we're threat-informed and -aware, but we also are looking from a technology perspective of where can we get the leap-ahead opportunities that can impose challenges to our adversaries and take our network to the next level. So we have to rely on them heavily, not only for some threat information, but also ... those unique potential opportunities from a technology perspective as well.” https://www.c4isrnet.com/battlefield-tech/it-networks/2020/07/20/how-new-prototyping-dollars-will-help-army-network-modernization/

  • Contract Awards by US Department of Defense - November 27, 2020

    30 novembre 2020 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

    Contract Awards by US Department of Defense - November 27, 2020

    NAVY Lockheed Martin Corp., Rotary and Mission Systems, Syracuse, New York, was awarded a $14,108,019 cost-plus-fixed-fee and cost-only modification to previously awarded contract N00024-18-C-5300 to exercise options for AN/SLQ-32(V)6 design agent engineering services. Work will be performed in Syracuse, New York, and is expected to be completed by November 2021. Fiscal 2021 other procurement (Navy) (91%); and 2021 operation and maintenance (Navy) (9%) funding in the amount of $3,008,846 will be obligated at time of award, of which, $281,857 will expire at the end of the current fiscal year. The Naval Sea Systems Command, Washington, D.C., is the contracting activity. (Awarded Nov. 24, 2020) *Small business https://www.defense.gov/Newsroom/Contracts/Contract/Article/2428811/source/GovDelivery/

  • CACI Awarded $80 Million Task Order to Provide Engineering Support Services to U.S. Navy Naval Surface Warfare Center (NSWC)

    3 septembre 2024 | International, Terrestre

    CACI Awarded $80 Million Task Order to Provide Engineering Support Services to U.S. Navy Naval Surface Warfare Center (NSWC)

    Through the ARPA Engineering Support Services task order, CACI will continue delivering expertise to ensure fleet systems are tested and assessed to maintain a high level of readiness and reliability.

Toutes les nouvelles