Part 4: How Defense Suppliers Should Use the CMMC Pause
The first three installments of this series addressed what the Department paused, what obligations remain in place, and why inaccurate cybersecurity representations can create False Claims Act exposure.
The final question is practical: What should an organization do now?
The pause creates time, but it does not create certainty. Organizations that wait for every question to be resolved may find themselves unprepared when new requirements are announced or when a prime contractor requests evidence. Organizations that proceed exactly as though nothing changed may spend money on an assessment that is not currently required or that would be better scheduled after important remediation work.
The right response is somewhere between those extremes. Continue the work that improves security and supports contractual compliance but reconsider the timing of the formal certification assessment based on business need.
The following actions can help defense suppliers use the pause productively.
1. Determine What Information You Actually Receive
Start with the information, not the technology. The goal is to identify what information is received from the Department, a prime contractor, or another subcontractor; and whether the information is FCI, CUI, or neither. Once the information is identified, answer these important questions:
- why the organization needs it;
- who can access it;
- where it is stored;
- how it is transmitted; and
- when it should be destroyed.
Many CMMC programs become unnecessarily expensive because the organization attempts to protect its entire enterprise as though every system contained CUI. Determining the right scope is critical to keeping the effort manageable. But remember, the goal is not the smallest possible scope, but instead, the smallest accurate and defensible scope. If the scope is too narrow, important copies, exports, email attachments, backups, or administrative systems can be overlooked.
2. Map the Flow of FCI and CUI
A data-flow diagram does not need to be an elaborate engineering document but should show enough information to gain an understanding of how sensitive information moves through the organization. Going through the data-flow exercise often identifies conditions that are not addressed in policies. These can include:
- CUI is downloaded from a portal to personal folders;
- drawings are emailed to suppliers;
- support providers can remotely access in-scope servers;
- CUI is copied into a ticketing system;
- backups are stored in a service that was not included in scope; or
- employees use an unapproved collaboration platform to send large files.
We recommend that all of our clients go through such an exercise to gain a better understanding of how and where their data goes. For CMMC purposes the discoveries from the exercise help define the real assessment boundary.
3. Review Contracts and Flowdown Requirements
Create an inventory of contracts and subcontracts involving defense information.
For each agreement, identify CMMC level or assessment requirements, what information is expected to be received, subcontractor flowdowns, and any customer-specific security requirements. The organization cannot accurately assess compliance without understanding what it agreed to do.
4. Reevaluate the CUI Environment Boundary
Once the information and contractual requirements are understood, review the systems that support the environment. The scope will include many obvious assets but also may include some components that are not as obvious. External service providers, network infrastructure components, logging systems, and backup systems are some areas that can end up in scope.
Also, do not assume that a system is out of scope merely because it does not permanently store CUI. A system may affect the security of the environment through general control actions like enforcing authentication or network protection. Document why each asset category is included, excluded, or treated in a particular manner.
5. Validate the Current SPRS Score
The pause is an appropriate time to revisit the organization’s NIST SP 800-171 assessment. Confirm that the correct version of NIST SP 800-171 assessed and that the correct environment was included. Take a look at the evidence that is being collected to ensure it supports the current assessment ratings. Remember, this score may have to be defended to a customer, assessor, or government reviewer. A lower accurate score is more useful and generally less dangerous than a higher score that cannot be supported.
6. Improve the System Security Plan
The SSP should become the central description of the environment rather than a document created solely for an assessor. Most importantly, it should be reflective of the current status of the items that make up the system. Responsible roles, external dependencies, inherited controls, and other items that can change often need to be up to date. The SSP does not need to contain every configuration setting. It should contain enough detail to explain how and where the requirement is satisfied.
7. Reevaluate POA&M Items
The pause is a good time to take a fresh look at every open Plan of Action and Milestones item. Each deficiency should be reviewed to confirm that it is still accurate, that it is eligible to remain on a POA&M, and that the proposed corrective action still makes sense. Management should also understand both the security risk and contractual risk created by the open item, whether compensating measures are in place, and whether the organization has committed enough budget, staff, and time to complete the work.
Priority should be given to deficiencies that affect multiple requirements or create material exposure. Weaknesses in multifactor authentication or privileged-access management are good examples.
The additional time created by the pause can be useful, but it should not become a reason to simply extend target dates. A POA&M should remain a tool for managing remediation, not a place where unresolved issues are allowed to remain indefinitely.
8. Review External Service Providers
Contractors should also revisit the external providers that support or interact with the CUI environment. For each provider, the contractor should understand what service is being performed, what access the provider has, which security responsibilities are assigned to the provider, and which responsibilities remain with the contractor.
A provider’s statement that it is “CMMC ready” should not be considered sufficient evidence. Contractors need to understand the service architecture and the division of responsibility between the parties. If that division is unclear, the risk usually remains with the contractor.
9. Build Evidence as Part of Normal Operations
Organizations should not wait until shortly before an assessment to begin collecting evidence. Evidence should be created naturally as part of operating the security program.
The timing of the evidence should match the timing of the control. If a control is expected to operate quarterly, there should be evidence from each quarter. If a control is expected to operate continuously, the organization should be able to demonstrate continued operation over time.
Good evidence is also more than a collection of screenshots. It should help answer basic questions: Who performed the activity? What was reviewed? What conclusion was reached? Were exceptions identified? What was done about them?
That type of evidence is far more useful than trying to reconstruct several months of activity immediately before an assessor arrives.
10. Establish a Management Affirmation Process
Executives should not be asked to sign an affirmation or approve a significant cybersecurity representation without enough information to understand what they are affirming.
A reasonable management process should provide a concise summary of the assessment scope, applicable requirements, current implementation status, material changes to the environment, open deficiencies, POA&M status, significant evidence limitations, and any unresolved issues. It should also identify the basis for the affirmation, and any remediation commitments management has accepted.
The objective is not to turn senior management into CMMC assessors or overwhelm them with technical detail. The objective is to provide enough reliable information for an executive to make an informed decision. An affirmation should be the end of a review process, not simply a signature added to a form.
11. Decide Whether Voluntary Certification Makes Business Sense
The Phase II pause changes the timing decision around certification, but it does not eliminate the business value of certification. For some organizations, continuing toward a formal C3PAO assessment may still be the right decision. A major customer may expect certification, upcoming opportunities may be likely to require it, or certification may provide a competitive advantage. An organization with a stable environment and mature evidence may decide that completing the assessment now is more valuable than waiting for further changes to the program.
For others, delaying the formal assessment may make better business sense. The CUI boundary may still be unclear, the System Security Plan may not accurately reflect the environment, or the organization may be going through significant changes. In those cases, it may be more effective to continue readiness work while delaying the formal certification expense.
Either way, the decision should be based on business factors, not be driven only by uncertainty around when CMMC will resume.
12. Obtain Qualified Third-Party Assistance
Internal teams understand their environment better than anyone else, but familiarity can also make it difficult to challenge long-standing assumptions. A qualified third party can provide a different and independent perspective.
A third-party review can also help identify differences between what the organization believes is happening and what the evidence actually supports. That can be particularly valuable before submitting an SPRS score or making a representation to a customer. While third-party assistance does not transfer management’s responsibility it can help management make better decisions based on a more complete and objective understanding of the environment.
How SynerComm Can Help
SynerComm has attained Registered Practitioner Organization status with The Cyber AB and has two Registered Practitioners on staff.
As an RPO, SynerComm provides non-certified CMMC advisory and implementation assistance to defense contractors and subcontractors. That includes CMMC and NIST SP 800-171 readiness assessments, CUI scoping and boundary analysis, System Security Plan development, and other assistance. While SynerComm can not issue CMMC certifications, we can help you prepare for official Level 2 certification assessments which must be performed by an authorized C3PAO.
Our objective is not simply to determine whether a requirement appears to be addressed. We help organizations determine whether the implementation is accurate, operating as intended, supported by evidence, repeatable, and defensible.
That distinction is particularly important during the current pause. Organizations have an opportunity to improve the quality of their cybersecurity program and the accuracy of their compliance representations before broader certification requirements resume.
Final Thoughts
The Department may make significant changes to CMMC. It may adjust who needs certification, when certification is required, or how the requirements are applied throughout the supply chain. Organizations cannot control those decisions.
They can control things like knowing where sensitive information resides, implementing required safeguards, and maintaining reliable evidence. The pause provides more time to do those things correctly. The CMMC program may change, but the obligation to safeguard defense information, and to accurately describe how that information is being protected, will remain.
This series provides general information and does not constitute legal advice. Organizations facing potential contractual, False Claims Act, disclosure, or incident-reporting concerns should consult qualified legal counsel.
