How to achieve the Defense Department’s CMMC compliance with Frank Smith

Welcome to the Test Guild Security Podcast.

Where we all get together to learn.

More about security testing with your host, Joe Calantonio. Hey, it's Joe. And welcome to another episode of the Test Guild Security podcast. Today we'll be talking with Frank Smith all about how to achieve Defense Department's CMMC compliance. Frank has over 25 years of expertise and experience and currently works as a manager at Intiva in the security and consultant practice. He is a certified information system security professional and registered practitioner with the CMMC accreditation body. He and his team has helped dozens of government contractors identify and address their requirements, develop their system security plans and set them on the path towards eventually obtaining CMMC Level 3 compliance. As you can tell, Frank has a lot of experience in this era and he has experience in all levels of security. So I'm really excited to have him on the show today. You don't want to miss this episode. Check it out. Hey Frank. Welcome to the Guild.

Joe. Thanks for having me.

Awesome to have you. As I mentioned in the pre show, I'm kind of a beginner to security, especially with cmmc. So I thought we'd take it at a high level and drill down into it I guess. At a high level, what is CMMC?

So DoD basically got tired of having unclassified information leaking out of defense company systems because quite frankly they just were doing the bare minimum and sometimes not even that. So they established a framework that says These are the 130 for Level 3 requirements in order to meet and get a CMMC Level 3 certification. So you meet all the requirements, a third party assessor comes in, verifies that it's good to go and you get a certification for three years. That's an entry point for being able to bid and work on defense contracts that have a CMMC level three requirement. It's actually not very new. December 2017, DoD put in a mandatory NIST 800171 compliance. And it was a self attestation, it was a trust model basically say roughly 80% of the defense industrial base didn't do it. They either didn't even know the requirement was there or they ignored it. And so three and a half years go by and you say well now we have a third party assessed, somebody's going to come in and prove that you're meeting the requirements model. So nobody has can complain about it really. You can't say that the opportunity wasn't there under the self attestation model. So now we have cmmc.

Great. So is CMC a requirement as of now, I thought I read somewhere it's not going to be like official requirements in 2026 or something like that.

It's phasing in. There have been no contracts released yet that have the requirement. There's up to 15 for this fiscal year may come out. It'll probably be significantly less than that given that it's already coming up on Memorial Day. But there will be some of them starting to come out. It will not be retroactive. It will only be as new contracts come out. So that's why there's this basically five, six year phase in period.

Gotcha. I guess what I'm also confused by is I just assume if you work for the government, you need to have security, security clearance. So why did the government create cmc? Like, what is the security concern that they have with contractors?

Got it. CMMC is designed specifically to address unclassified work. Not every company that does business in the Federal Government and DoD in particular, Works with classified information, but there's a ton of stuff out there. It's all generically now called Controlled Unclassified Information, or cui. It's sensitive, but it doesn't meet the requirements for being classified. The flip side to that, though, is that if you take enough cui, you can paint a pretty good picture of what's going on. You come up with a lot of details that maybe otherwise aren't there. But some categories of CUI are just basic things. Social Security numbers, dates of birth, you know, lots of privacy information. There's actually like 125 categories that were identified. They came out during the Biden administration. In 2010. There was an executive order that defined it. National Archives is the executive agency. You can go to their website and get the entire list of 125 categories and every one of those are considered CUI, I guess.

How is this different from other cybersecurity standards?

It's related. Say 90% of it derives from the NIST 800 171. NIST 800171 is A. I'll call it a subset. It's not the best way to describe it, but a subset of the NIST853, which covers FedRAMP and data processing on federal systems. And ultimately they all kind of share a basis back in the ISO 27000 series of kind of cyber standards. So while they are cyber centric, there are a lot of things about CMMC that is not really cybersecurity. You're not going to go out and buy a tool and deploy it and it's going to magically a problem. It's a lot of process, it's policy, it's how your HR department interacts with it and how people get their background checks done and who determines who has access to what systems. And how do you maintain, you know, cross checks so that when employees leave that their accounts are terminated and they can no longer access data. So it's fairly broad. There are plenty of things though that can be done with it obviously to address the CMMC requirements.

All right, so Frank, I guess my next question then is if I'm a contractor, do I need to be certified or does the company I work for need to be certified? Like does the whole organization need to be certified or is it just groups within the company? Is it just the contractor themselves?

Yeah, so the CMMC structure allows what's known as data enclaves. So if you have a very large company, you can say only this portion of the company. This, these are the guys that touch the defense contracts or even within the defense contracting group, these are the company or these are the business units that maybe will touch CUI and you can isolate it and say this portion of the company will be CMMC certified. Smaller and mid sized businesses are going to have a tougher time making a determination on how to set up a data enclave though. And the folks that will be touching the data, you know, obviously anybody who's performing work on the contract, but does the data go into the contracts folders and do the contracts managers have access to it and how can they effectively operate the business without touching the data or at least potentially having access to it? If a RFP comes from the government and the statement of work would have typically been classified with a for official use only designation or something like that, it probably in the future will come out with a CUI note on it. So now your business development people have to have access to cui. And so smaller and mid sized companies, like I said, are probably going to basically do the entire company. Larger organizations may segment them and come up with these enclaves and structure it in such a way that the CUI and the certification only applies to a certain portion. It's kind of like most certifications really. You get to define the scope. If you want to do an ISO 27001, you work with the auditor and say here's the scope, it covers these facilities, it doesn't cover those, you know, those kind of things.

Great. So I guess how does someone know they need to be certified? I guess like if you're a contractor and you work for the dod, I guess it's obvious. But other companies or situations where you think people aren't even aware that maybe even though they may not work with the DoD yet or directly that they would need to be certified.

Yeah. So DoD's official position so far is that, you know, roughly 20% of the defense industrial base will need a CMMC level three and 80% would need a CMMC level one. And level one just covers federal contract information. Level two exists, but it's not ever going to really be used for anything. It's considered a transitional level. My personal opinion is that DoD has that exactly backwards that in fact it's going to be 80% of the companies are going to go after a level three and only 20% that do the most basic types of things are going to go after a level one. There's a couple reasons for that. One is the natural tendency to err on the side of caution. And if in doubt, if something is considered cui, the program offices are going to err on the side of caution and say it's cui. The other part of that is a tendency, I think on the defense industrial base itself that says I'm going to potentially want to bid on CUI work and that's going to require I have that Level three, therefore I'm just going to go ahead and do it right now. It's not a huge lift from being compliant with the NIST 800 standard that was put out three and a half years ago to CMMC. If you're going to try to meet the one, you might as well meet them both. And it's not going to stay just in dod, especially with all these supply chain attacks that have been happening. The Colonial pipeline one last week, I mean, drove it home to everybody. The supply chains are vulnerable. Everybody has to up their game. And you're going to see the large, you know, the big defense contractors, the Lockheed's, the Raytheons, the General Dynamics, they're going to force some of these requirements deeper into their supply chains than maybe they have to. And they're going to do it over an abundance of caution too, because they're ultimately responsible for problems that happen in their supply chains too. So I think you're just going to see all of this go, but I'll put in this plug for compliance and just good cyber practice. If I were to go through the 130 requirements that are part of CMMC Level 3, most companies should be doing most of those things anyway. There are some things in there that I call are form over function and that happens. But by and large, if you're doing any kind of business, don't you want to protect your systems? I mean your proprietary data, you don't want that getting out, do you? Right. So up your cyber game, put some of those minimums out there. And I'm shocked. Day in and day out when I see companies and go, you don't have mfa, you're sending account information, clear text emails. It's shocking sometimes what companies do. And it's like, put compliance aside. You need up your game.

Absolutely. Now you've spoken on different levels one and three. I believe there are five levels to CMC compliance and I thought maybe we'd go through each one. You've touched on a few just to get people what it means to go from one to five. So I think one is performed is the process and there's like a practice like basic cyber hygiene. Can you talk a little bit about step one?

Yeah. So level one is literally the most basic. It actually is just pulling requirements out of the federal acquisition reg that have been there forever. And it says if you want to do business with the federal government, you have to meet these 17 most basic requirements. If you're not meeting the 17, shame on you. You turn your computer off and go home. That will be a fairly easy bar for companies to meet. As you move up the chain for cmmc, the number of requirements increase, but you also have to demonstrate more maturity. And that's the one of the M's is the maturity model. Right. You're basically saying, I'm doing the minimum, I'm getting by, I'm putting some more structure around it, I'm making it a more repeatable process, I'm putting a level of formality into it. And at the same time I am upping my technology. Level two, as I said, is really just a transitional level. DoD doesn't really intend to issue any requirements at level two. Level three is the minimum level for controlling CUI. And as I said, I think that's where most companies are going to target. 4 and 5 are considered additional controls and requirements to protect high value programs. Now when the model was announced, they were estimating that that's going to be somewhere like if my memory is right, like 80 contracts might come out with a level four or five. And four is considered, I think, more transitional. Also. If you're going to go towards four, you're going to basically go to five. But the number of companies that will meet that level is pretty small and they are probably already in pretty good shape because they may even already be processing classified information. So for them it will be a structural kind of change, but not a huge lift for them.

I don't think, as you mentioned, if someone's already doing some sort of security program at the company, level one seems like it's just basic cyber hygiene. So is it most likely. A lot of companies already have this in place and it's just a matter of validating it or getting, you know, DOD to recognize that they actually meet level one.

Yeah, they will need to have a third party assessor come out and actually do a level one audit. They should be fairly quick and easy. We don't really know what any of this is going to look like yet. There are no certified companies, There are some provisional assessors. Defense Contract Management Agency operates something called the DIBCAC out of Fort Lee. And the DIBCAC is doing the first assessments of companies that want to be assessors. And so they are just starting down that path. They will be level three assessments. So once the infrastructure comes out a little bit and we see what the training curriculum looks like, I think we'll have a better idea on the complexity of what all those will look like. But I think a level one audit should be fairly quick. Maybe a couple of assessors, a couple of days tops come in. Yes, validate what you're doing and move on. A level three assessment is probably, you know, four people for a week, maybe two. That would be on the extreme, I think, but you know, the market price is going to dictate what all that looks like. So but if you look at the other assessment methodologies that are out there now, a soc audit, an ISO 27001 audit and ISO 9000, I mean these things are all 30, 40, $50,000 to have the assessments done. So that's where the defense industrial base has been kind of pushing back on dod saying this is going to cost me a lot of money to get well and it's going to cost me a lot of money to have my assessment done. In DoD's defense, the amount of money to get well should be pretty low for companies because they've been certifying that they've been doing this since December of 2017 and under that self attestation model. So you kind of can't say I have to go spend a lot of money to fix things because you should have been doing most of it already. But we are where we are and the assessments are expected to be good for three years. That's the current plan, I haven't heard anything that there will be the, you know, the annual touch with like a mini assessment or anything. So three years, they're considered allowable costs in the government's accounting standard, but they are not direct costs. So companies will be allowed to include them in their overhead, but it won't be something where you can simply turn around and pass the bill on to the government. That said, though, there are a ton of programs out there, the Small Business Administration has money available. DOD has been sending money to various state agencies, you know, to help, especially manufacturers. I think they're going to have a tougher time to meet some of the compliance things. So there is money out there to help offset some of the costs.

So how descriptive is cmmc? The reason why I say this, I know there's a lot of companies, as you mentioned, the cost is very expensive to get audited manually. There's a lot of solutions coming on the market that automate some of this to make you compliant. Is this something that could be automated or is it like, is it that hard in stone? Exactly what needs to be to get compliance? Is it more like you actually need an auditor to manually go through all your assets to see if you've achieved compliance?

So when the assessors come on to actually do your assessment, they're going to be looking at process policy and technology and they're going to be validating that in a bunch of different ways. So they will, like interview the folks that are responsible for implementing something. They're going to look at your written policy, they'll look at the technology and make sure that that policy is implemented. They may in fact look at it and say, okay, you have a process that says on a monthly basis, it sits down with HR and validates that everybody that left the company has had their accounts disabled and we're clear on all of that. The assessors then are going to turn around and say, okay, show me the meeting minutes. Prove that you've in fact done what you said you have done. You can go in and say, well, here's their account. You can see the box is checked, it's been disabled. But you have a policy and a process. You need to also validate that that's being done correctly too. There is not going to be a simple automation that's going to make CMMC easy. I'd even go one step further, that it's a little disingenuous for some of the companies out there that are guaranteeing some type of a pass, because it just isn't going to be possible. Most of the tools out there will help you with assessments, but you're still having to fill in and say, here's my policy, here's my process. And that's sort of part of that concept of maturity. Right. It's written down. I have a defined process, I follow it, I can prove that I follow it, and I have technology to enforce it.

Absolutely. I come from a healthcare background and worked for a large healthcare company. Almost sounds like an FDA audit where it's actually you define the process, but you need to be able to explain the process so that the auditor is just going through and just seeing what you said you do and asking you to validate it. So I guess the company themselves are what define what they're going to be audited for. It's not no gutches really.

I'm guessing I go back and forth on this. In some ways I wish DoD would be more prescriptive and say, here's the requirement, but for some of the requirements and I'll use vulnerability scanning as an example. This is a little pet peeve of mine. So I admit that up front, the requirement is, is that you define a policy for doing periodic vulnerability scans. And basically then you need to demonstrate that you do those periodic vulnerability scans. Well, if I have an internal policy that says my periodic vulnerability scans are once a year and I do a scan once a year and I prove to you that I've done a scan once a year, I've basically met that requirement, but I haven't really met the intent of that. Right. But when you really look at it, if DoD wanted monthly or quarterly or whatever periodic scans, I would have rather have just seen it come out and say, do monthly vulnerability sketch and be done with it instead of leaving it up to interpretation. So there's a lot of things in the standard that are kind of. I liken them to baseball rules. I had season tickets at Nats park for many, many years. I also am a volunteer baseball umpire. And baseball rules from the outside don't make sense, but internally they are consistent. And so within cmmc there's a similar problem. In some ways, you can go through several of the controls and make them internally consistent and I suppose say compliant. But you're still at the mercy of a judgment call of an auditor to say, well, that wasn't really the intent. And for some things, it might be just better to say we want 15 character passwords that change every six months and meet all four of the complexity requirements. You know, just put it down and and make the judgment parts of it go away.

Absolutely. It always like once again reminds me of an FDA audit. It all depends on the whim of the auditor. You don't know what they're going to call out or what one auditor sees, maybe not what another person sees or what is right in the end. So it is kind of. Yeah.

And there is a. Fear isn't the right word, but it.

Might be what's fair.

Yeah. That because this is expected to be a market driven environment for assessments, that cheaper assessments which will appeal to everybody might be less rigorous and that some companies that have a longer history of doing these type of assessments will be more in line with what the entire ecosystem expects. But that, you know, smaller companies that are trying to break in are going to come in and do it at a lower cost and in fact might not have that same, that same level of thoroughness maybe simply because they are trying to do it for a lower cost.

Interesting. So I don't know how you work around that then because it's third party vendors then that are doing this. Right.

Yeah. And the thing I haven't mentioned. So DoD established the framework. It has been turned over to a third party body, which is the CMMC accreditation body. They have a no cost contract with DOD and the accreditation body in and of itself as a nonprofit will manage this whole process for DoD. So between those two organizations, they're basically saying we're not going to set a price. When DoD published this in the Federal Register initially they had, you know, it's DOD in the Federal Register. Right. We think the Paperwork Reduction act costs and all those other kind of things and they put all their estimates in there were absurdly low, though. I don't even. They were so low that I think I just discounted them initially and never really looked again. The cost to do this for companies is much higher than what I think they expect. But the bottom line for a typical DoD contractor that, you know, has a small office, has a back office, staff contracts, hr, the president of the company, all those kind of things, has a fair number of people work on government sites because it's a lot of defense contractors do that, the impact to the bottom line is negligible. It's just not going to be that big of a deal. Yes. When you say, oh, I'm going to spend 30,000 for an audit and it's going to cost me 50,000 to produce some new documentation and I've got to spend 50 grand to do some new technologies and my monthly recurring costs are going up by several thousand dollars. Divide that over the hundreds and thousands of hours of billions billable time that you have to the government and it's pennies. Right. So it's going to have an impact, but it's not going to be, you know, I have to go out of business now. That small 10 person company, maybe just starting out, veteran owned small business, kind of working out of the garage. Right. It only has maybe, you know, 10 or 15 employees. Yeah, they're going to feel it much more than, you know, a company 75 to 100 and then on, you know, and up from there.

Great. So I'm just looking over my notes. I know we covered the five levels of CMMC. I also have 17 capability domains.

Yeah. So the, the requirements are grouped into domains. You know, physical security is one and then there's a bunch of controls in physical security and identity and access control and it's a category and they're grouped like that. Actually if you really trace it all the way back, the genesis of that is all in the ISO 27000 stuff. That was the first place that it started being grouped that way. And it's a very convenient way it puts like controls together for CMMC compliance. I'm telling everybody you better have a written policy and procedure for each one of those 17 families of controls. And then within there you're going to implement something specific. But you need an overarching policy and process for physical security. And you know, that's everything from who manages the key cards to is the building locked and is your IT equipment in a separate storage. And you know, just everything you can possibly imagine is addressed in there. And there's a lot of overlap too. So 130 controls for level three, there's 10 or 12 of them that all basically say the same thing with, regarding access to logs. So every company out there right now has every log turned on they possibly can and never looks at them unless something breaks. And the requirements use a variety of words, but it's review, monitor, analyze, store, protect, audit your logs. You don't have to treat each one of those controls separately. You can look at it and say I'm going to go use a SIM solution and it's going to protect and it's going to analyze and it's going to monitor my logs and all the those kind of things. And then I just have a process for monitoring my siem.

Cool. So Frank, in your intro I mentioned that you helped set the path towards eventually helping companies obtain CMC level 3 compliance. So you work for Intiva. Is that something Intiva does or how do you help companies get to that, get ready to get that kind of compliance?

Sure. So Intiva is a managed service provider. We do outsourced it and when I joined the company a few years ago I looked and said, you know, there's lots of small businesses in the D.C. area that would benefit by outsourcing their IT. And then CMMC came out a few months after I joined and I was like, hey, this is an opportunity. So I took the Level 3 requirements and mapped them against a managed service providers kind of out of the box solutions and said, look, we do vulnerability patching, right? A lot of companies don't, they don't have a ability to push every time Microsoft sends out changes to Windows. Those are just core functions of a managed service provider. Well, here's the extra things we need to do to help companies meet CMMC requirements. So we kind of structured a plan around it that said we can help you with a lot of these controls from a technology side and at the same time we can guide you down a path that says here's what we think you need to be doing on the policy and procedure side. Now we can help with some of those things, but if you want somebody to come in and write HR policies and help you with your contracts flow and you need to involve other people than it, and there are companies out there that will help you with all that policy stuff. And, and we've been referring folks to some of our partner companies. I am an engineer by training background. You don't want me writing some of your policies because it's going to sound like an engineer wrote them.

Right.

But at the same time you can Google CMMC policies and you're just going to get a bunch of blank templates. You cannot just simply substitute company name in there. I mean you need to capture what you're really doing. So we can help companies, basically we look at their current environment, we look at their policies, their procedures, their technologies and we help them create the roadmap for what they need to do to get from where they are to where they can be CMMC level 3 compliant.

So can you talk, Frank, a little bit about the DoD assessment methodology, what they use?

Yeah. So the NIST 80171 requirement that I mentioned, that has been mandatory Since December of 2017, DoD created an assessment methodology and basically it's a scoring algorithm that says give me your system security plan, which is based on that 800171 and I'm going to start you with 110 points. And I'm going to deduct either 1, 3 or 5 points for every one of the controls that are not fully implemented. And that came out. And then CMMC got this big energy and everybody focused on CMMC and the DoD assessment methodology kind of took a little bit of a backseat. Well, DOD turned around and said, no, CMMC is going to phase in over five or six years and there's enough pushback. We're going to reinvigorate this assessment methodology. So starting in November of last year, every company doing business basically has to score their own system security plan, which was that self attestation model, and upload that score into the supplier performance risk system that DoD maintains. And that's basically required before you can get an award. So while CMMC is phasing in, the DoD assessment methodology score started back on November 30th and everybody panicked because there were a lot of companies didn't have system security plans and they didn't have any method of scoring them. So you need to create that system security plan in the short term. That is your stepping stone to level three. Anyway, your score can be anywhere from 110, which is a perfect score, all the way down to a minus 203. Only DOD could have come up with that as a scoring algorithm. But that score has to be uploaded and that's required right now, today. And this is kind of the precursor to full implementation of cmmc.

Okay, Frank, before we go, is there one piece of actionable advice you can give to someone to help them with their CMMC efforts and what's the best way to find or contact you?

Yeah, so the, I mean, you got to know where you are. You need a gap assessment, you need a system security plan. Those are absolutely required right now. If companies don't have them, you're putting all your DoD dollars at risk. But you will never get to CMMC, even level one, unless you do an assessment and say, where am I today? Here's where I want to be. And you draw a map, phase it in. I mean, it's not like you have to throw a switch and go spend all that money right now, today. As you pointed out, it's phasing in. Spend the money over the next 18 months, 24 months, 15 contracts in 2021 was the target, 75 in 2022, that would have CMMC requirements. That's not that many contracts. 450 was the plan for 2023. Now it's a big jump, right? So let's look at it and say we're partway through FY 2021. Realistically, you have 18 months to figure out where you are, where do you want to be, close the gaps, have the assessment done and put yourself in a good place. All your competitors are spending the money too. This is a pay to play model, right? If you want DoD business, you will spend the money. That's where the previous model fell apart. Some companies implemented it and basically put themselves at a cost disadvantage because their competitor hadn't spent the money but was saying that they had. And so they do the gap assessment, come up with a plan, budget it for the next 18 months, maybe two years even, and go for it from there. We have a ton of stuff on our website@intiva.com how to do it, what a level three looks like, where we can help you meet level three. We can help you with a lot of things, but I can't help you with physical security because it's your building and you know you need to maintain a visitor control log and stuff like that. So like I said, not everything is technology, but it's a lot of process and policy stuff as well.

And Frank, the best way to contact.

You is@intiva.com or intiva.com would work. Or you could even send it to franktiva.com and I have that email address available that you can send it to me directly.

Thanks again for your security testing awesomeness. For links to everything of value we covered in this episode, head on over to test guild.com.

And if the show has helped you in any way, why not rate and review it in itunes? Reviews really do matter in the rankings of the show and I read each and every one of them. So that's it for this episode of the Test Guild Security Podcast. I'm Joe and my mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers. Thanks for listening to the Test Guild Security Podcast.

Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.