Statement of the Hon. Dean Phillips — CMMC Implementation: What It Means for Small Businesses (June 24, 2021)

Summary

A statement of the Hon. Dean Phillips dated June 24, 2021, on Cybersecurity Maturity Model Certification (CMMC) implementation and what it means for small businesses. The statement describes the CMMC as a framework that seeks to improve the protection of sensitive unclassified information across the Defense Industrial Base, which it says is composed of over 300,000 companies. It says many small businesses are concerned about the significant costs of CMMC compliance and that the initiative has the potential of driving many small businesses out of the defense industrial base. It also says the DOD will implement the CMMC initiative on select contracts between FY2021-2025.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Statement of the Hon. Dean Phillips on CMMC Implementation: What It Means for Small Businesses
Source(print): https://democrats-smallbusiness.house.gov/news/documentprint.aspx?DocumentID=3798

Statement of the Hon. Dean Phillips on CMMC Implementation: What It Means for Small Businesses 

 democrats-smallbusiness.house.gov 

 Cmte Small Business (D) 

 Contact: 

 Statement of the Hon. Dean Phillips on CMMC Implementation: What It Means for Small Businesses 

 Washington ,
 June 24, 2021 
 -

 Cyber-attacks have the potential to threaten public safety and undermine the American economy and national security. The early months of 2021 provided harsh reminders of this fact. Over the past 6 months, hackers and other malicious actors have held an oil pipeline for ransom, breached the nation’s largest transit network, and attacked private companies to obtain sensitive customer data. 
   
 According to the Council of Economic Advisors, malicious cyber activity cost the U.S. economy between $57 Billion and $109 Billion in 2016. With our society’s reliance on technology and digitization growing, there’s no doubt that cyber-attacks will only become more prevalent moving forward. Recognizing the urgency of cyber threats, the Department of Defense has taken steps to protect sensitive defense information from attacks aimed at the over 300,000 companies that compose the Defense Industrial Base. 
   
 One of these efforts has been the creation of the Cybersecurity Maturity Model Certification. The CMMC is a framework that seeks to improve the protection of different types of sensitive unclassified information through the implementation of a unifying security standard across the DIB. The CMMC framework consists of a tiered system, with a series of processes and practices at each level. The program was designed based on numerous cybersecurity standards and frameworks. 
   
 CMMC relies on third-party certification to assess the relative cybersecurity maturity of DIB companies. Thus, when the initiative is finally implemented, and all contracts have requirements incorporating a specific CMMC level, only those contractors who have achieved the required CMMC level through the certification process will be eligible for an award. 
   
 The need for cybersecurity is unquestionable. It’s vital that companies in the DIB become more resilient and prepared for cyber-attacks. With that said, the CMMC initiative has the potential of driving many small businesses out of the defense industrial base. Therefore, we must get it right. To this end, it is important to pay attention to the numerous red flags small businesses have raised about the initiative. For example, many small businesses are concerned about the significant costs associated with CMMC compliance. 
   
 Guarding against cyberattacks can be cost prohibitive for many small businesses. Firms that seek to abide by CMMC must purchase new hardware and software, replace outdated technology systems, and pay the costs of initial certification and maintenance among other expenditures. Small businesses often run on thin margins, and the cost of CMMC has the potential to leave many small firms in the sector without a chance to compete for government contracts. 
   
 Many small businesses also don’t have the capacity to deal with the complexity of the initiative. Employees at small enterprises often wear many hats and have limited regulatory or compliance resources. This means that independent firms will be forced to turn to outside specialists for help navigating the program. For many small contractors, this is not feasible. 
   
 According to department plans, the DOD will implement the CMMC initiative on select contracts between FY2021-2025. In addition, in March, DOD initiated an internal assessment of CMMC partially guided by an effort to manage cybersecurity costs for small businesses. 
   
 This is a timely hearing, as it allows us to take a closer look at this program and its implications for small businesses. There’s no doubt that contractors working with the DOD must have adequate systems to handle cyber threats. At the same time, we cannot allow program requirements to drive small businesses out of the Defense procurement space.

File and source

File

3798_2021-06-24_statement-of-the-hon-dean-phillips-on-cmmc-impleme.txt

Size

4,258 bytes

SHA-256

92db216208ce3614025d7d046ceaa246e5b8f8bd5bb64e51f9c6670b86e02105

Our copy

3798_2021-06-24_statement-of-the-hon-dean-phillips-on-cmmc-impleme.txt

Original

No public link identified.