Federal Contractors: Cybersecurity Program
Enabling the Department of Defense Industrial Base Community
America’s adversaries begin targeting defense contractors as soon as the Department of Defense (DoD) announces contract awards.
Many contractors mistakenly believe that their DoD contracts are not important enough to garner attention. The DoD recognizes that the entire Defense Industrial Base (DIB), regardless of contract type, is susceptible to exploitation. America’s adversaries seek DoD contract information to assemble seemingly minor pieces of information, so that they may organize the multiple pieces into meaningful intelligence to sabotage DoD efforts.
Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) and each contractor's proprietary defense information must be both protected and shareable. The DoD determined that NIST 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, is the framework defense contractors must implement.
The DoD also created the triennial Cybersecurity Maturity Model (CMMC) to validate contractor's implementation of the NIST 800-171 frameworks. The CMMC contract clause was released in December 2023. The The phased roll-out of CMMC as a contractual clause is scheduled to launch Q3 2024. CMMC assessments will be available in Q1 2025, but it is recommended that organizations do not wait until Q3 2024 to start their readiness assessments.
The Right Processes for the Right People at the Right Time
The Federal Contractors Cybersecurity Program is a four-phased program that provides the DIB lifecycle support for DoD cybersecurity contract requirements. We understand that meeting CMMC assessment requirements is an enterprise responsibility, not just a technical issue.
Our commitment focuses on partnering with each CUI stakeholder during the NIST and CMMC journey. This allows our team members to realize business implications, in addition to IT challenges, while travelling through a phased approach to understanding CUI, NIST and CMMC contractual requirements.
CMMC as a Business Imperative
Typically, consultants address CMMC through the technical lens, starting with the NIST 800-171 gap analysis and conclude with elements to prepare for the CMMC assessment process. That approach, however, lacks the first step in any process: Identification. Without identifying DoD CUI handling requirements, subsequent NIST 800-171 and CMMC success may not translate into contract compliance. It is possible to pass a CMMC assessment and achieve an NIST 800-171 score of 110 yet still be non-compliant with the contract if contractual CUI handling requirements were never initially validated. That is why identification is vital.
Our team of seasoned professionals considers CMMC a business problem and offers a unique approach to address this challenge. We perform DoD contract analysis and identify CUI that needs to be protected up front, resulting in a more refined scope of work and increased success rate for compliance. This approach allows us to tailor services to provide NIST 800-171, self-assessment support, accurate CMMC documentation, and CMMC assessment coaching. Upon successful awarding of a CMMC, we also provide ongoing support for the required annual assessments and subsequent contracting arrangements.
CMMC as a Competitive Edge
DIB early adopters that pursue compliance validation of existing contract clauses and prepare their organizations for the inevitable CMMC contract clause better position themselves in the extremely competitive defense contractor space. Protecting CUI is now the new normal. Getting ahead of defense contractors that wait facilitates correct proposal costing, expands the number and types of bidding opportunities, and mitigates loss of reputation if compromised.
Why Wait
The CMMC industry is in its infancy, and qualified Cyber Accreditation Board ("Cyber AB") Registered Practitioners (RPs) and the consultants who prepare for CMMC are at a premium. EisnerAmper is a Registered Practitioner Organization and employs credentialed Cyber AB consultants who not only understand NIST frameworks and CMMC assessments, but also know DoD contracts and the new DoD CUI program.
EisnerAmper has extensive experience with DoD contracts, NIST implementation strategies, and CMMC readiness. EisnerAmper Advisory Group is a Cyber AB Registered Professional Organization.
Our Services:
- Identify Contractual DoD CUI Handling Requirements
- Offer Allowable Expenses Consulting
- Develop Contract Compliance Strategies
- Provide NIST 800-171 and 172 Scoping, Assessing and Scoring
- Implement Control Gap Analysis and Recommendations
- Create Tailored Policies, Plans, Standards, Procedures
- Offer Virtual Chief Information Security Officer Services
- Perform Vulnerability Scanning
What's on Your Mind?
Start a conversation with the team