The estimated read time for this document is 3 minutes and 30 seconds.
The monthly Cyber AB town hall for September took place on Tuesday, September 27th. During this month’s townhall members of the Cyber AB staff distributed information and fielded questions on the following agenda:
- CMMC program Updates
- CMMC Myth busters
- Checking in with DIBCAC w/ Nick DelRosso
- Introducing the CAICO
- Updates on the draft CAP and the CCP Beta examination
- The CMMC 2.0 Ecosystem Summit
CMMC Ecosystem and Program Updates
The following is a list of the program updates and priority issues covered during CEO Matt Travis’s opening remarks:
- The CMMC pool of assessment organizations continues to grow consistently. As of this month's town hall, 26 CMMC 3rd Party Assessment organizations have been authorized by the Cyber AB.
- The first 3 Joint surveillance volunteer assessments are in the process of completing administrative tasks to reach completion.
- A total of 55 OSCs signed up to have a voluntary Joint surveillance assessment performed on their organization.
CMMC Myth Busting
In what has become a re-occurring segment of the Cyber AB town halls, CEO Matt Travis utilized a small sample of the meeting time to address common misconceptions discovered over the previous month. This month, these myths were debunked by Mr. Travis:
- Any talk of CMMC 3.0 is simply just speculative. Mr. Travis has had numerous conversations with people in authoritative positions who confirm that this is not an idea presently on the radar of DoD.
- The CMMC Code of Ethics is NOT exclusive to C3PAOs. It is a code of conduct expected to adhere to all members of the CMMC Ecosystem.
Checking in with DIBCAC
During this month’s town hall, DIBCAC Director for the Defense Contract Management Agency (DCMA), Nick DelRosso joined the Cyber AB as a staff to provide insights into the results and trends which have been encountered during DIBCAC assessments of DIB organizations. Here are some of the key takeaways from his presentation:
- DIBCAC has curated a list of the top 10 NIST 800-171 requirements that were determined to be other than satisfied “OTS”. These controls (listed in order of frequency) included: FIPS Validated Encryption (3.13.11), Multi-factor Authentication (3.5.3), identifying, reporting, and correcting system flaws (3.14.1), Periodically assessing risk (3.11.1), Vulnerability Scanning (3.11.2), Reviewing and update logged events (3.3.3), Alerting on audit process failures (3.3.4), Audit record review, analysis, and reporting processes (3.3.5), Testing of incident response capabilities (3.6.3), Establishing and maintaining baseline configurations (3.4.1)
- DIBCAC discovered that 38% of all organizations receiving assessments have failed to adequately deploy Multi-Factor Authentication. In some of these cases, implementation attempts were made but did not completely cover the assessment scope.
- If an organization has deployed FIPS validated Encryption mechanisms where the cryptographic module certification has expired; DIBCAC is not considering this as the organization completely failing to meet the expectation. Instead, these organizations will be granted an “other than satisfied” determination due to a temporary deficiency that is out of their control. The OSC will need to POAM this control and may receive partial credit (3/5 points) for the control.
- DIBCAC conducted an analysis of all SPRS submissions and found that the average score of all organizations was 66. The analysis also revealed an average increase of only 3 points in organizations submitting scores for a second time.
- DIBCAC also analyzed medium-level assessments between 07/2021 and 03/2022 and found 156 instances where the score reported decreased by at least 100 points when validated by DIBCAC. This includes one case where a contractor had an SPRS score of 110 (best possible) but was validated with a score of –203 (worst possible).
- The average SPRS submission of all organizations in the study was 56.125; the average of the medium assessment scores of those same organizations was –57.25.
- 26% of all self-attested “basic assessment” scores submitted were 110
- 79% of all organizations receiving a medium assessment received a score of 110
- 49% of organizations who participated in a DIBCAC High assessment received a score of 110.
- In a comparison of the scoring of Basic to Medium assessments. A slide representing the actual scores of 16 contractors was provided. Only 1 set of contractor data showed an improvement in scores between their basic and high assessment. Only 2 scored above 50 on their medium assessment. And 7 of the 16 contractors saw self-attested scores of 50+ turn into validated scores of negative values.
Introducing the CAICO
The Cybersecurity Assessor & Instructor Certification organization (CAICO) separates the accreditation of OSCs and other ecosystem organizations from the certification of the professionals in the ecosystem. The CAICO is the new authoritative body for credentialing and training CMMC professionals. This organization is a subsidiary of the Cyber AB which will be governed by a board of managers under the oversight of new executive director (and former Cyber AB board member) Melanie Kyle Gingrich. This organization allows the Cyber AB to operate within the requirements of ISO/IEC 17011; and will feature a separate logo and website, as well as multiple other CAICO-specific features.
Some examples of the roles and responsibilities of the CAICO include but are not limited to:
- Certifying CMMC Assessors and Instructors through examinations
- The engagement and enablement of the training community to develop and provide quality CMMC curriculum and courses.
- Provide information, non-certification specified training.
- Facilitating the suitability process for professionals
- Engaging the CMMC ecosystem to further evolve the CMMC program.
CAP feedback and CCP Exam Updates
There were updates provided around the draft CAP document released and the progress of beta examinations for Certified CMMC Professionals (CCP).
- The Cyber AB just received DoD Consolidated CAP feedback and has extended the comment period to the public until 9/30. Mr. Travis intends to keep the ecosystem up to date on any potential changes to the document.
- The CCP Beta exam period ended on 9/28. Moving forward the CAICO is reviewing the data and feedback from the CCP exam and that data will be used to refine and improve the exam and its experience.
- Provisional assessors and LTP-trained CCPS will be allowed to take tests starting October 19th.
Finally, the 1st annual CMMC Ecosystem Summit will take place on November 9th in Tysons Corner, Virginia. The official agenda for the event is expected to be released by October 9th.
The next Cyber AB Town Hall is scheduled to take place on Tuesday, October 25th.
R&D Engineer, Dynamics & Controls Engineer (GNC), Mechanical Engineer
1yI would really like to see the stats on the companies that were assessed by DIBCAC: 1) Size of the company (or size of in-scope system) 2) Age of the company in years 3) Whether or not the company had dedicated cybersecurity/IT staff 4) Self-assessed score 5) DIBCAC assessed score 6) The factors that most heavily contributed to the disparities (i.e. Did they just lie? Or were the controls or policies deficient? The discrepancy between self-assessment scores and DIBCAC assessed scores highlights two problems: The first-- which will get the most attention, is that DIB companies' cybersecurity has been lacking. The second is that expectations of the DIBCAC (and eventually CMMC third party assessors) have not been communicated effectively outside of the cybersecurity/policy bubble. Moving from self assessment to a rigid third party assessment, but keeping the very flexible (yet specialized) language of the SP800-171? Disaster, I think. If the intent is to improve small company cybersecurity, then the policy has to be translated for that audience. To that end, publishing where the aforementioned companies failed would be extremely useful in helping to set the bar for new and small companies who have not been audited or assessed.