Cmmc Implementation: What It Means for Small Businesses (House Small Business subcommittee hearing, June 24, 2021)
Summary
Transcript of the House Committee on Small Business Subcommittee on Oversight, Investigations, and Regulations hearing CMMC Implementation: What It Means for Small Businesses, convened June 24, 2021 during the 117th Congress, First Session, published as Small Business Committee Document Number 117-021 (GPO 44-926). Opening statements were delivered by Hon. Dean Phillips and Hon. Beth Van Duyne. Witnesses were Jonathan T. Williams of PilieroMazza PLLC, Scott Singer of CyberNINES, Tina Wilson of T47 International, Inc., and Michael Dunbar of Ryzhka International LLC testifying for the HUBZone Contractors National Council, with appendix materials from Ho-Chunk Inc., IPC and the National Defense Industry Association.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Cmmc Implementation: What It Means for Small Businesses (House Small Business subcommittee hearing, June 24, 2021).”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/cmmc-implementation-what-it-means-for-small-businesses-house-small-bus-388564396e/
, SHA-256 3e81bd1246a10bf31ff5de99618b334714108a25ca02a3bbd6711423d6298acf.Full text
CMMC IMPLEMENTATION: WHAT IT MEANS FOR
SMALL BUSINESSES
HEARING
BEFORE THE
SUBCOMMITTEE ON OVERSIGHT,
INVESTIGATIONS, AND REGULATIONS
OF THE
COMMITTEE ON SMALL BUSINESS
UNITED STATES
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
HEARING HELD
JUNE 24, 2021
Small Business Committee Document Number 117–021
Available via the GPO Website: www.govinfo.gov
U.S. GOVERNMENT PUBLISHING OFFICE
44–926 WASHINGTON : 2021
SBD026 with DISTILLER
Congress.#13
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00001 Fmt 5011 Sfmt 5011 F:\DOCS\44926.TXT DEBBIE
HOUSE COMMITTEE ON SMALL BUSINESS
NYDIA VELÁZQUEZ, New York, Chairwoman
JARED GOLDEN, Maine
JASON CROW, Colorado
SHARICE DAVIDS, Kansas
KWEISI MFUME, Maryland
DEAN PHILLIPS, Minnesota
MARIE NEWMAN, Illinois
CAROLYN BOURDEAUX, Georgia
TROY CARTER, Louisiana
JUDY CHU, California
DWIGHT EVANS, Pennsylvania
ANTONIO DELGADO, New York
CHRISSY HOULAHAN, Pennsylvania
ANDY KIM, New Jersey
ANGIE CRAIG, Minnesota
BLAINE LUETKEMEYER, Missouri, Ranking Member
ROGER WILLIAMS, Texas
JIM HAGEDORN, Minnesota
PETE STAUBER, Minnesota
DAN MEUSER, Pennsylvania
CLAUDIA TENNEY, New York
ANDREW GARBARINO, New York
YOUNG KIM, California
BETH VAN DUYNE, Texas
BYRON DONALDS, Florida
MARIA SALAZAR, Florida
SCOTT FITZGERALD, Wisconsin
MELISSA JUNG, Majority Staff Director
ELLEN HARRINGTON, Majority Deputy Staff Director
DAVID PLANNING, Staff Director
(II)
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00002 Fmt 5904 Sfmt 5904 F:\DOCS\44926.TXT DEBBIE
CONTENTS
OPENING STATEMENTS
Page
Hon. Dean Phillips .................................................................................................. 1
Hon. Beth Van Duyne ............................................................................................. 3
WITNESSES
Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC, Washington, DC ....... 5
Mr. Scott Singer, President, CyberNINES, Madison, WI ..................................... 7
Ms. Tina Wilson, Chief Executive Officer, T47 International, Inc., Upper
Marlboro, MD ....................................................................................................... 8
Mr. Michael Dunbar, President, Ryzhka International LLC, Pompano Beach,
FL, testifying on behalf of the HUBZone Contractors National Council ......... 10
APPENDIX
Prepared Statements:
Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC, Washington,
DC .................................................................................................................. 25
Mr. Scott Singer, President, CyberNINES, Madison, WI ............................. 33
Ms. Tina Wilson, Chief Executive Officer, T47 International, Inc., Upper
Marlboro, MD ................................................................................................ 42
Mr. Michael Dunbar, President, Ryzhka International LLC, Pompano
Beach, FL, testifying on behalf of the HUBZone Contractors National
Council ........................................................................................................... 44
Questions for the Record:
None.
Answers for the Record:
None.
Additional Material for the Record:
Ho-Chunk Inc. ................................................................................................... 51
IPC Report June 2021 ...................................................................................... 59
National Defense Industry Association (NDIA) ............................................. 74
(III)
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00003 Fmt 5904 Sfmt 0486 F:\DOCS\44926.TXT DEBBIE
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00004 Fmt 5904 Sfmt 0486 F:\DOCS\44926.TXT DEBBIE
CMMC IMPLEMENTATION: WHAT IT MEANS
FOR SMALL BUSINESSES
THURSDAY, JUNE 24, 2021
HOUSE OF REPRESENTATIVES,
COMMITTEE ON SMALL BUSINESS,
SUBCOMMITTEE ON OVERSIGHT,
INVESTIGATIONS, AND REGULATIONS,
Washington, DC.
The Subcommittee met, pursuant to call, at 10:01 a.m., in Room
2360, Rayburn House Office Building, Hon. Dean Phillips [chair-
man of the Subcommittee] presiding.
Present: Representatives Phillips, Davids, Evans, Craig,
Hagedorn, Meuser, Van Duyne, and Fitzgerald.
Chairman PHILLIPS. All right. Good morning, everybody. I call
this meeting to order.
And without objection, the Chair is authorized to declare a recess
at any time.
Let me start by saying that the standing House and Committee
rules and practice will continue to apply during hybrid proceedings.
All members are reminded that they are expected to adhere to
these standing rules, including decorum. House regulations require
members to be visible through a video connection throughout the
proceeding, so please keep your cameras on. And also, please re-
member to remain muted until you are recognized to minimize
background noise. And turn your microphone on when you are rec-
ognized, of course.
If you have to participate in another proceeding, please exit this
one and log in later. In the event a member encounters technical
issues that prevent them from being recognized for their ques-
tioning, I will move to the next available member of the same party
and I will recognize that member at the next appropriate time slot,
provided that they have returned to the proceeding.
For those members and staff physically present in the Committee
room today, we will continue to follow the most recent OAP guid-
ance. Masks are no longer required in our meeting spaces for mem-
bers and staff who have been fully vaccinated. All members and
staff who have not been fully vaccinated are still required to wear
masks and socially distance. I do hope that we do all our parts to
protect each other and our staff.
With that, I will begin with my opening statement. Cyber attacks
have the potential to threaten public safety and undermine the
American economy and national security. The early months of 2021
have provided harsh reminders of this very fact. Over the past 6
months, hackers and other malicious actors have held an oil pipe-
(1)
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
2
line for ransom, breached the Nation’s largest transit network, and
attacked private companies to obtain sensitive customer data.
According to the Council of Economic Advisers, malicious cyber
activity has cost the U.S. economy between 57- and $109 billion
since 2016. With our society’s reliance on technology and
digitization growing, there is no doubt that cyber attacks will only
become more prevalent moving forward.
Recognizing the urgency of cyber threats, the Department of De-
fense has taken steps to protect sensitive defense information from
attacks aimed at over 300,000 companies that compose the Defense
Industrial Base, the DIB. One of these efforts has been the creation
of the Cybersecurity Maturity Model Certification. The CMMC is a
framework that seeks to improve the protection of different types
of sensitive, unclassified information through the implementation
of a unifying security standard across the DIB.
The CMMC framework consists of a tiered system with a series
of processes and practices at each level. The program was designed
based on numerous cybersecurity standards and frameworks.
CMMC relies on third-party certification to assess the relative cy-
bersecurity maturity of DIB companies, thus when the initiative is
finally implemented and all contracts and requirements incor-
porated a specific CMMC level, only those contractors who have
achieved the required CMMC level through the certification process
will be eligible for an award.
The need for cybersecurity is unquestionable. It is vital that com-
panies in the DIB become more resilient and prepared for cyber at-
tacks. With that said, the CMMC Initiative has the potential of
driving many small businesses out of the Defense Industrial Base,
therefore, we must get this right. To that end, it is important to
pay attention to the numerous red flags that small businesses have
raised about this initiative.
For example, many have a concern about the significant cost as-
sociated with CMMC compliance. Guarding against cyber attacks
can be cost prohibitive for many small businesses. And firms that
seek to abide by CMMC must purchase new hardware and soft-
ware, replace outdated technical systems, and pay the costs of ini-
tial certification and maintenance amongst other expenditures.
Small businesses often run on thin margins as we know, and the
cost of CMMC has the potential to leave many small firms in the
sector without a chance to compete for government contracts. Many
small businesses also don’t have the capacity to deal with the com-
plexity of the initiative. Employers at small enterprises often wear
many hats and have limited regulatory or compliance resources.
This means that independent firms will be forced to turn to outside
specialists for help to navigate the program. For many small con-
tractors, this will not be feasible.
According to Department plans, the DOD will implement the
CMMC initiative on select contracts between fiscal year 2021 and
2025. In addition, in March, DOD initiated an internal assessment
of CMMC partially guided by an effort to manage cybersecurity
costs for small businesses. This is a very timely hearing, as it al-
lows us to take a closer look at the program and its implications
for small businesses. There is no doubt that contractors working
with the DOD must have adequate systems in place to handle
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00006 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
3
cyber threats. At the same time, we cannot allow the program re-
quirements to drive small businesses out of the defense procure-
ment space.
With that, I would like to yield to the Ranking Member, Ms. Van
Duyne, for her opening statement.
Ms. VAN DUYNE. Thank you, Mr. Chairman. We should have
compared notes before we gave our opening statements, because I
am going to echo many of the sentiments that you just shared.
Just a few short weeks ago, we saw how a malicious ransomware
attack perpetuated by foreign actors on the Colonial Pipeline can
cause chaos across the entire Eastern Seaboard. And not long after
that, another attack shut down one of the leading meat producers
in the United States. The potential for profit and opportunity to
disrupt U.S. critical infrastructure has invited a number of cyber
criminals to target U.S. network vulnerabilities and one of the soft-
est targets to obtain valuable Department of Defense information
is through our small contractors.
Recognizing the increased vulnerabilities of small contractors,
the DOD initiated new cybersecurity assessment framework, called
the Cybersecurity Maturity Model Certification, to assess con-
tractor implementation of cybersecurity requirements. While no one
disputes the Federal Government’s need to address the growing cy-
bersecurity risks facing our Nation, I am deeply concerned that the
CMMC has created yet another hurdle to keep small businesses
from competing in the defense marketplace, exactly what we just
heard from our Chairman.
A major concern is the cost of compliance. No matter how you
look at it, adding stringent cybersecurity requirements will be a
costly endeavor for small businesses that are already recovering
from a pandemic. With limited resources compared to the competi-
tors in the defense contracting space, small businesses are under-
standably wary of deploying that capital without assurance that
their investment will return in future work.
The Federal Government has already experienced a 38 percent
decline in its industrial base for the past decade and measures like
this will only exasperate this exodus. Simply put, we need to en-
sure a competitive contracting environment for small business.
This would not only benefit our small employers, but would be a
net benefit for our national defense.
I also have major concerns with the rollout of the CMMC for a
number of reasons. First, the assessments may be inconsistent and
unfair because the new process is being handled by many newly
trained assessors. There are also many questions outstanding
about how subcontractors will be treated under this new frame-
work.
And, finally, I am worried that small contractors will be shut out
of the conversation entirely, and forced to the end of the line.
The fact is that this new process may threaten the livelihood of
many small businesses. No assistance, no assessment means no
certification, and no certification means no work. Small businesses
rightly fear that they won’t be given a fair share, left to fend for
themselves, as we have too often seen when it comes to sweeping
government reforms.
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
4
Dealing with cyber threats is an extremely nuanced issue that
will require continued collaboration, and while the DOD may have
good intentions with the CMMC initiative, we must ensure that the
voices of small businesses operating in the Defense Industrial Base
are heard and have their concerns addressed. I look forward to
hearing the testimony of the witnesses today.
And I yield back.
Chairman PHILLIPS. Thank you, Ms. Van Duyne. The
gentlelady yields back.
And I will just take a moment to explain how the hearing will
proceed.
Each witness will have 5 minutes to provide a statement and
each Committee member will have 5 minutes for questions. Please
ensure that your microphone is on when you begin speaking and
that you return to mute when you are finished.
With that, I would like to introduce our witnesses.
Our first witness is Mr. Jonathan T. Williams, partner with the
law firm of PilieroMazza in Washington, D.C. As Chair of their
government contracts group, he counsels companies on a variety of
Federal acquisition regulation compliance issues. Mr. Williams is
also a member of PilieroMazza’s cybersecurity and data privacy
team. In this role, Jon works with Federal contractors, particularly
those who contract with the DOD, on managing cybersecurity and
establishing compliant and effective safeguards. We appreciate
your expertise on today’s topic.
Our second witness is Mr. Scott Singer, president of
CyberNINES with offices in both Wisconsin and Minnesota. Mr.
Singer is a retired U.S. Navy captain bringing over 30 years of
military experience in both Active Duty and Reserve roles, along
with 26 years of industry experience. His company, CyberNINES,
is a service-disabled veteran-owned small business, focused on cy-
bersecurity services and a candidate third-party assessment organi-
zation for CMMC. We appreciate you as well, Mr. Singer, for your
contributions to today’s discussion.
Our third witness is Ms. Tina Wilson, founder and Chief Execu-
tive Officer of T47 International, located in Upper Marlboro, Mary-
land. Ms. Wilson is an Air Force veteran, and T47 International is
an 8(a) veteran-owned, and women-owned small business, offering
a wide range of professional support services to the defense com-
munity. We thank you also for sharing your story today.
With that, our Ranking Member, Ms. Van Duyne, will introduce
Mr. Dunbar.
Ms. VAN DUYNE. Okay. Hold on just a minute. Thank you very
much.
I would like to welcome our final witness, Mr. Michael Dunbar.
Mr. Dunbar is the president of Ryzhka International, a service-dis-
abled, veteran-owned small business founded in May of 2011, and
a HUBZone certified firm as of February of 2014. They have lubri-
cants and fuel oil to government, commercial, and maritime clients
worldwide, and proudly provide 100 percent American-made prod-
ucts. From its initial founding to today, the company has grown
from one to six employees and successfully serves clients ranging
from the U.S. Army Corps of Engineers, the Department of Vet-
erans Affairs, the U.S. Navy and Coast Guard, the National Oce-
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
5
anic and Atmospheric Administration, various shipyards in many
of the dredging community.
Ryzhka International has been the proud recipient of several
awards. This is the Department of Defense’s award for support of
the Guard and Reserve. And in addition to its businesses, the com-
pany’s secondary mission is to provide gainful employment opportu-
nities to qualified individuals from disadvantaged segments of soci-
ety, such as minorities, women, people with disabilities, and vet-
erans.
Chairman PHILLIPS. And we will begin with Mr. Williams—oh,
I am sorry.
Ms. VAN DUYNE. Sorry. You are good. You are good. The sec-
ondary focus is no surprise considering Mr. Dunbar’s own military
service in the U.S. Navy Nuclear Power program and its status as
a service-disabled veteran. After his military service, Mr. Dunbar
went on to spend the summer working on the solid rocket boosters
for National Aeronautics and Space Administration’s space shuttle.
Following that summer, he attended the University of Utah,
went on to have a successful career as an executive in the biotech
industry, and afterwards, started his own company. Mr. Dunbar
will be speaking today on behalf of the HUBZone Contractors Na-
tional Council, which is a nonprofit trade association advocating for
policies bringing opportunities to HUBZone certified small busi-
nesses and the economically disadvantaged communities in which
these companies are based.
Mr. Dunbar, thank you for your participation today. We look for-
ward to hearing your testimony.
I yield back.
Chairman PHILLIPS. Thank you, Ms. Van Duyne. The
gentlelady yields back.
Sorry, Mr. Dunbar. My bio is about one sentence long, so I am
not accustomed to two pages.
With that, we are going to recognize Mr. Williams for 5 minutes
for your opening statement. Mr. Williams.
STATEMENTS OF JONATHAN T. WILLIAMS, PARTNER,
PILIEROMAZZA PLLC; SCOTT SINGER, PRESIDENT,
CYBERNINES; TINA WILSON, CHIEF EXECUTIVE OFFICER,
T47 INTERNATIONAL, INC.; AND MICHAEL DUNBAR, PRESI-
DENT, RYZHKA INTERNATIONAL LLC, TESTIFYING ON BE-
HALF OF THE HUBZONE CONTRACTORS NATIONAL COUNCIL
STATEMENT OF JONATHAN T. WILLIAMS
Mr. WILLIAMS. Good morning, Chairman Phillips, and other
distinguished members of the Subcommittee. My name is Jonathan
Williams, and I am a partner with the law firm PilieroMazza,
which represents government contractors. Many of our clients are
small businesses that work with the Department of Defense as
prime contractors and subcontractors. It is an honor to participate
in this hearing on DOD Cybersecurity Maturity Model Certification
to share my perspective on the CMMC Initiative.
DOD’s focus on cybersecurity has been steadily building for many
years, with measures ranging from implementation of new regula-
tions and contract clauses to the elevation of cybersecurity as the
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
6
fourth pillar of DOD’s acquisition planning. DOD has left no doubt
about the importance it has placed on enhancing cybersecurity for
the Defense Industrial Base, and with good reason, as recent
events like the pipeline shutdown demonstrate.
CMMC marks a significant change in DOD’s evolving approach
to cybersecurity. With CMMC, contractors will no longer be allowed
to use the honor system by self-certifying their cybersecurity. In-
stead, contractors will have to apply for certification from a third-
party assessor. These so-called C3PAOs will evaluate the contrac-
tor’s cybersecurity against established benchmarks and decide
whether to certify the contractor in one of five levels.
The lowest level of CMMC is level one, which requires the fewest
and most basic cybersecurity measures. The level one requirements
are things all businesses should be doing, like spam filters and
antivirus software. The cost and complexity of the requirements in-
creases significantly at the higher levels of CMMC.
DOD has said it intends to start requiring CMMC on a few con-
tracts this fiscal year with that number increasing steadily over the
next several years until fiscal year 2026, when all DOD contractors
will be required to have CMMC.
However, the implementation schedule has slipped a few times
already and remains in flux. Approximately 2 years into the
CMMC Initiative, many practical questions that small businesses
are asking remains unanswered. These are basic questions like,
when will I need CMMC? How much will it cost? What level do I
need? And how do I get it?
Many small businesses will not be able to adequately prepare for
CMMC until these questions are answered. For example, DOD esti-
mates that most small businesses will only need level one; how-
ever, that is not guaranteed. DOD agencies are more likely to re-
quire at least level three for many of their contracts, and prime
contractors may flow down the same level to their subcontractors.
Given the substantial difference in cost and technological know-
how between level one and level three, many small businesses will
be unable to compete if more than a level one is required. From my
discussions with the small businesses we represent, I have several
suggestions for how to make the CMMC Initiative more manage-
able for small businesses, including the SBA and DOD mentor-pro-
tege programs should be utilized to ensure that mentors provide
small businesses with resources and guidance to obtain CMMC.
Joint ventures, a popular tool for small businesses to pursue gov-
ernment work, should not be required to have CMMC when the
member companies are certified. C3PAOs should be required to
fast-track CMMC applications when the applicant is a small busi-
ness that is in line for award of a contract.
DOD contract clauses should prohibit prime contractors from im-
posing a more stringent level of CMMC on a subcontractor than is
necessary based on the scope of the subcontract.
And finally, DOD and prime contractors should explore alter-
native ways to give small businesses access to sensitive information
that will enable more small businesses to participate on DOD con-
tracts with a level one certification.
In closing, I believe the CMMC Initiative appropriately aims to
improve our Nation’s cybersecurity posture. I do not think small
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
7
businesses would debate the importance of cybersecurity, or that
doing business with the Federal Government is a privilege that re-
quires investments in compliance and infrastructure.
At the same time, the worthy goals of the CMMC Initiative must
be calibrated to avoid creating an unnecessarily high barrier to
entry for small businesses, which are the engine of our economy
and critical partners with the Federal Government for innovation
and provision of many necessary services and supplies.
This concludes my testimony. Thank you, again, for the oppor-
tunity to appear before you today.
Chairman PHILLIPS. Thank you, Mr. Williams. A perfect 5 min-
utes at that. We appreciate it.
Now we recognize Mr. Singer for 5 minutes.
STATEMENT OF SCOTT SINGER
Mr. SINGER. Thank you, Representative Phillips, Ranking Mem-
ber Representative Van Duyne, and members of the Subcommittee,
for inviting me to testify this morning. I look forward to providing
information that will help ensure we have a secure Defense Indus-
trial Base and find cost-effective solutions to allow small business
to fully comply with CMMC.
My name is Scott Singer, and I am the owner and president of
CyberNINES. CyberNINES was founded only in June of 2020; how-
ever, thanks to the interim final rule released on November 30,
2020, we have been really busy. And I have done assessments in
the districts of some of the members of this Subcommittee. Small
businesses do not have purchasing or IT departments. They do not
have compliance or regulatory departments. We need to make this
easier for them. Primes, certified third-party assessors, registered
provider organizations, all can assist these small businesses get
compliant and reduce the complexity for them.
Having a program where the primes take a strong guiding hand
of their supply chain is critical to maintaining these small busi-
nesses as DOD suppliers. Of the last 33 basic assessments
CyberNINES has conducted, the average compliance score was
minus 105. Plus 110 is perfect. We have found that on average,
they are about only 34 percent of the way toward meeting all the
risk controls. Cost models put forth by the government assume that
companies are much further along on this journey, and they actu-
ally should be by this point.
Assuming full compliance to NIST, the DOD has put out that
this will cost $26,000 to complete the 20 additional practices fol-
lowed by an additional $29,000 to be assessed by a C3PAO. As dis-
cussed above, small businesses that we have assessed are only
partway there, and we have come up with costs more to the tune
of about $130,000 for these businesses to be able to be compliant.
Last week, I conducted a basic assessment of a small manufac-
turer in Minnesota. They had only six employees, one small manu-
facturing space with three machines, and they do excellent innova-
tive work. I spent a good majority of my time doing the assessment
actually from the owner’s house. This year, he expects to make
875K in revenue. My estimate is that if he wants to stay a DOD
contractor, he will have to spend 10 percent of his revenue over the
next 3 years alone on getting compliant.
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
8
Small businesses have been directed to add their allowable costs
to get compliant to their indirect rates. Most don’t do cost reim-
bursement contracting for DOD. Moreover, market factors around
competition for orders will require them to compete and lower
prices. Established contractors will be more likely to be able to pro-
vide a lower bid and win the order from the prime. There should
be a process separate from the competitive marketplace to allow
small businesses to get paid for the reasonable, necessary, and al-
lowable cyber compliance expenses.
Companies further ahead should not be penalized and be able to
recoup their past expenses, too. In addition to the difficulty small
businesses have funding this effort, there are bottlenecks for get-
ting enough assessors. In doing the math, I just don’t see how—
and this is my opinion—we can get enough C3PAOs and assessors
through the process to assess 300,000 DIB companies by October
1, 2025. I saw one estimate that we would need over 8,000 assess-
ment team members working full-time from today on to make this
happen.
To get more C3PAOs through the process, I recommend there be
a relaxation for the initial C3PAOs. Assess candidate C3PAOs to
maturity level one or two now, and then require level three in the
future. The requirement for tier three background investigations
for assessment and support staff creates another bottleneck. I
would recommend allowing an interim clearance process for that.
In conclusion, the majority of the 300,000 contractors in the DIB
are small businesses. Without monetary support and clear regu-
latory guidance, the DOD will lose small businesses as they will
look to find business in the commercial sector. A balance must be
struck between risk and cost. Too much cost, we lose suppliers; too
much risk, and we hurt our national security.
Thank you for allowing me to testify, and I look forward to your
questions.
Chairman PHILLIPS. Thank you, Mr. Singer. And now we recog-
nize Ms. Wilson for 5 minutes.
STATEMENT OF TINA WILSON
Ms. WILSON. Chairman Phillips, Ranking Member Van Duyne,
and members of the Subcommittee, thank you for the invitation to
testify today. I am Tina Wilson, CEO, T47 International, and I am
honored to have the opportunity to provide some insight regarding
the implementation of DOD CMMC Initiative.
As a business owner with over 260 employees located in 28
States and overseas, T47 provides a variety of staffing services
from budget and finance, janitorial, inventory management, air-
craft tools, maintenance to mail room, and nonclinical medical and
dental case managers. The diversity of services offered puts me in
a unique position to provide a different perspective regarding this
subject.
As CMMC standards continue to be developed and incorporated
into contract agreements and modifications, it is essential that the
Small Business Committee be aware of the policy impact. If the
CMMC standards are not clearly communicated and monitored for
fraud, the financial ramifications to the over 300,000 Defense In-
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
9
dustrial Base of contractors, and specifically to the small business
community, could be devastating.
Based on this statement, I will cover three main subject areas of
concern and offer recommendations.
Cost to secure CMMC. As of today there is no set cost to obtain
CMMC. The CMMC accreditation body has stated that the market-
place will need to define the cost, which leaves it wide-open for in-
terpretation what this cost will be. Whether it is a tiered cost based
on the size of the business, or a set cost regardless of the size,
there will be initial and sustained cost that will impact small busi-
nesses’ ability to secure the certification.
A similar certification offered by the International Organization
for Standardization, ISO, is standard 27,000, which is information
technology and focuses on security for any kind of digital informa-
tion. This certification costs between 28- to $35,000 to obtain, and
takes approximately 6 to 8 months to implement. This is a tremen-
dous cost burden to add to a very tight budget for most small busi-
nesses.
Cost of not having CMMC. While unknown as of today, what has
been communicated to the entire Defense Industrial Base is that
if you don’t have CMMC at the basic level, you will not be eligible
for a Federal contract. Many small businesses may not even be
aware this new requirement and failure to obtain certification
means ending contract work as a service provider to the DOD.
Additionally, as the prime contractor, it will be our responsibility
to flow down the requirements to our subcontractors. If the subcon-
tractor does not have certification, we would be required to end
subcontract agreements to remain compliant with the DOD CMMC
standards.
Audit imposters. I raise this subject as an awareness to inform
the Subcommittee. When the DOD presented the CMMC as the
new way of life for all businesses within the Defense Industrial
Base in the summer of 2019, many business owners asked a lot of
questions of why? Who will conduct the implementation and audit?
How much? When will it happen? Implications, or if you do not
have it, and many more questions.
Before the CMMC accreditation body was formed in the latter
part of 2019, audit imposters with no training and not accredited,
start advertising that they will certify your company as cyber com-
pliant for thousands of dollars to get a company ready. For many
small businesses that are just now hearing about this standard,
may in a moment of panic and fear of losing their government con-
tract, may fall prey to an audit imposter.
As I close, I recommend that the Subcommittee members closely
monitor this very important implementation of CMMC Initiative.
While I know there are so many other issues to focus on, CMMC
has ramifications that reach far beyond what we can realize at this
moment.
It is important that, one, cost is articulated clearly to reduce
price gauging and to allow the small businesses to plan; number
two, a balanced cost approach that does not reduce small business
participation in the Federal marketplace; number three, DOD con-
tinues to work closely with various advocacy groups to ensure that
the Defense Industrial Base contractors, known at the Office of
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00013 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
10
Small Business, is aware of this implication to this new initiative;
and four, DOD and the Office of Small Business start as soon as
possible to put various roadblocks in place to reduce the number
of audit imposters.
Thank you for your time in addressing this very important sub-
ject that impacts thousands of small businesses that do business
with the Department of Defense.
Chairman PHILLIPS. Thank you, Ms. Wilson.
And now I recognize Mr. Dunbar for 5 minutes.
STATEMENT OF MICHAEL DUNBAR
Mr. DUNBAR. Chair Phillips, Ranking Member Van Duyne, and
members of the Subcommittee, thank you for the opportunity to
testify before you today. My name is Michael Dunbar, and I am the
president of Ryzhka International, located in Pompano Beach, Flor-
ida.
Ryzhka International provides lubricants, fuel oil in bulk quan-
tities, package quantities to the Federal Government, commercial
maritime industries. I am a proud service-disabled, veteran-owned
small business, as well as a HUBZone certified small business.
I am testifying today on behalf of the HUBZone Contractors Na-
tional Council, a nonprofit trade association providing information
and support for companies and professionals interested in the
Small Business Administration’s HUBZone program. We would like
to thank the Committee for its commitment to small business and
for advancing policies that support small businesses doing business
with the Federal Government.
In a recent hearing, Deputy Assistant Secretary of Defense of In-
dustrial Policy, Jesse Salazar, said it best: The Department’s ap-
proach to cybersecurity must balance the need for accountability
with the recognition of the challenges facing small businesses.
Small businesses understand the importance of cybersecurity,
and the very real threats facing their companies. We are not look-
ing for a way to opt out or ignore this problem. We want to secure
our companies. According to the DOD’s contracting data, 74 percent
of the Defense Industrial Base are small businesses. These contrac-
tors are critical to the government, and are not a group that can
be ignored.
The Federal Government has long identified the need to safe-
guard sensitive information and understands that cybersecurity is
dynamic issue. Small businesses, however, are experts on the goods
and services they provide. We do our best to focus on supplying a
product, making a profit, and retaining employees. Most small
businesses are not IT professionals. We are not cybersecurity spe-
cialists either. I am—right here is the assessment guide. This is for
cybersecurity CMMC model level three. It is full of stuff I have no
idea and don’t understand. I have to hire somebody to figure this
out.
The initial cost for me to start my business was less than $1,000.
The cost to start a new government-focused business with this,
10,000, 100,000; we really don’t know. Access to capital can be a
very challenging issue for small businesses, and we have to use sig-
nificant capital now to become CMMC certified.
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00014 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
11
The segments hurt most are the segments that can least afford
it. The Federal Government already has challenges meeting those
goals. If we reduce the number of companies that qualify, you also
reduce opportunity for people to start up new businesses in those
sectors.
The council makes the following recommendations to improve the
rollout of CMMC, and maintain a strong industrial base. Increased
cost transparency and put guardrails on rising compliance costs for
small business. One of the biggest frustrations for small business
throughout the rollout has been cost transparency. Some small
businesses have estimated costs in excess of $100,000 to prepare
for level three certification. That doesn’t include the assessment
costs. I have heard of assessment costs already estimated at above
$150,000 for a 50-person company.
Establish clear communication on CMMC efforts. A lack of trans-
parency, clear, consistent communication by the DOD, and the roll-
out of CMMC and its implementation by the CMMC accreditation
body has been concerning. The council suggests putting together a
more clear, consistent delivery of information through a central
government platform or website.
Streamline new and existing standards for contractors. The Fed-
eral Government lacks unified cybersecurity standards across all
agencies. The council encourages the DOD to work closely with in-
dustry, particularly small businesses, to streamline these require-
ments allowing companies to have a plan of action and milestones
after a CMMC assessment would help these burdens.
Create a system for oversight and equitable rollout. Many small
businesses worry that they will be put at the back of the line and
face massive delays as companies serve the subcontractors, and eq-
uitable rollout is important to these companies as well.
In conclusion, the Federal Government has a long and complex
history of governing cybersecurity regulations and compliance with
its contractors. A streamlined approach needs to be taken for con-
tractors to navigate all of these standards and system successfully.
Thank you for the opportunity to testify today, and I look for-
ward to your questions.
Chairman PHILLIPS. Thank you, Mr. Dunbar, and to all of our
witnesses for being with us today and we appreciate your testi-
mony on the CMMC Initiative.
I will begin the hearing now by recognizing myself for 5 minutes.
I will start with Mr. Williams.
I think we all understand the importance of cybersecurity, and
ensuring that the most vulnerable small businesses in the DIB
supply chain are protected. However, it is clear that the cost of
CMMC could be terribly burdensome for small businesses. So how
should we be looking at this? How can we strike the right balance
between enhancing cybersecurity, and ensuring that small busi-
nesses can participate in DOD acquisitions?
Mr. WILLIAMS. Yes. Excellent question. Thank you. I think one
of my top suggestions there is to try to make good on DOD’s esti-
mate that most small businesses will only need level one. As I said
in my testimony, that is not guaranteed, but if we can keep as
many small businesses as possible at level one, that will strike the
right balance between ensuring that these small businesses have
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
12
at least the basic cybersecurity protections in place, but will allow
them to avoid, as Mr. Dunbar said, the significant additional costs
when you go from a level one to a level three.
And I think managing the level one versus level three distinction
is probably one of the most critical ways to keep the cost down for
small businesses. That could be done through flow-down protec-
tions. Make sure that primes are not flowing down higher than
level one if their subcontractors only need level one. And I would
like to see more flexible approaches where the small businesses
don’t need to take the controlled unclassified information into their
own network, because that is what then causes the jump from level
one to level three.
Let’s look at ways that either the DOD and their own systems,
or the prime contractors and their own systems, can maintain this
information, and let’s maybe be more creative and flexible in how
we allow small businesses to participate on those programs without
having to take that information into their network, and then cause
them to have to go up to a level three.
Chairman PHILLIPS. Appreciate that. Are there any funding
streams of which you are aware that can help small businesses
with the costs of CMMC? And if there is anything that Congress,
DOD, or even SBA could do to help in that regard, no matter how
significant the expenses might be?
Mr. WILLIAMS. I am not aware of specifically targeted funding
stream at CMMC. I think it would be a fantastic idea if there was
the wherewithal for a grant program for small businesses to help
them on their way with the upfront investments needed for CMMC.
The larger small businesses will be able to make that investment
and get it on the back end when they are paid on their contracts
with the government, but for the smaller firms, even the several
thousand dollars of the investment needed for a level one might be
too difficult to make upfront.
And I think the existing mentor-protege programs, as I men-
tioned, those are fantastic programs. They work very well in many
respects at the SBA and DOD for small businesses and large busi-
nesses. There are a lot of incentives that large business mentors
get from participating in those programs.
We could be clearer, more well-defined that mentors, when they
are permitted to access those programs, have to ensure that one of
the things they are doing for their proteges is to provide financial
resources and technical assistance to ensure their proteges are
ready for CMMC.
Chairman PHILLIPS. Thank you very much.
Ms. Wilson, I would love to hear from you about your experience.
How were you made aware of CMMC? How difficult is it for you
and T47 to understand, and do you envision having to engage a
consultant or specialist to help you navigate it?
Ms. WILSON. Sure. Thank you for the question. I learned about
CMMC when attending a DISA Industry Day in 2019 up in Balti-
more. I understand completely how it works and, you know, from
a broader perspective, but, you know, protecting supply chain, in-
telligence, assets, IT infrastructure and, you know, things that
matter to protect in our Nation.
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00016 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
13
And for T47, the critical part is, we have to secure a specialist,
which I have already engaged, because it is very complex. And for
someone that is non-IT like myself—I am a business owner. I know
how to go get contracts and build a company, but to build an IT
infrastructure that impacts a lot of employees and be able to main-
tain it and go into other secured areas, it is a challenge.
So to actually have an expert to help us is going to be critical,
and I have engaged in that process already.
Chairman PHILLIPS. Thank you very much. My time is expired,
and now I recognize the Ranking Member, Ms. Van Duyne, for 5
minutes.
Ms. VAN DUYNE. Thank you very much. Mr. Dunbar, okay,
hold that up one more time. You need two hands. That is—I mean,
I completely understand your frustration right now. Do you believe
that the CMMC duplicates any of the multiple standards in cyber-
security programs that currently exist? Do you find that there is
a bunch of stuff that is already existing right now that is in that
book that you are going to have to do more of? And is there a way
to further streamline these disparate processes?
Mr. DUNBAR. Thank you very much for the question here. From
what I understand—and I am not a technical expert, so I will an-
swer from a layman’s perspective—CMMC added, I believe, 20 ad-
ditional items to NIST 800-171, which is currently the law of the
land and what exists today. So what is being projected to be our
new standard is built on an existing standard, and part of me ques-
tions why we had to go so much further.
The reasoning behind putting CMMC in place, part of it was be-
cause we were doing self-assessments before for companies instead
of having a third-party assessment. Why could they not institute
some part of third-party assessment to an existing standard? Why
create a whole new standard that people have to learn and under-
stand to begin with?
And I didn’t have to deal with the first standard because most
of my business is what they call is called COTS, which is
Commerical-Off-The-Shelf products; however, fuel recently, as we
just saw with Colonial Pipeline, has become a very critical item. Is
supplying fuel by truck, by whatever method all of a sudden going
to become a CMMC level four like the infrastructure piece of it
might potentially need to be? That is going to impact a significant
number of small businesses like mine.
So by adding these additional items, we ask our question as to
why, and how do we streamline this? I have in place security right
now that covers 77 of the NIST items—covers 77 of the CMMC
items, but covers 90 percent of the risk. So is that additional cost-
benefit, and we are talking 80 to $100,000 of additional cost to get
that other 10 percent realistic for small business?
Ms. VAN DUYNE. I am concerned that the critical information
about CMMC is being conveyed in a conflicting and potentially in-
formal manner. What are small businesses currently going to seek
information or guidance on CMMC? Where are you going to find
more information? And then, what would be the ideal method or
platform of communication from the DOD to the contracting com-
munity? How can we make it easier?
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00017 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
14
Mr. DUNBAR. The main place that we have been receiving infor-
mation tends to be LinkedIn. We have had members of DOD com-
municating directly through LinkedIn, members of the CMMC
board communicating through LinkedIn. That tends to be the larg-
est location or community of folks getting information on this pro-
gram. We get very little from DOD directly. They have had some
town halls that they call it. You don’t really get much notice, if
any.
Just the other day was mentioned a project spectrum, I believe
it is called, that I had never heard of, that was put in place, it
looks like some time in 2020. Most small businesses are unaware
of this as well, and this is supposed to help us somehow, it is a
DOD program, but we are not even aware of it.
Ms. VAN DUYNE. Your being sent to a website is probably not
going to help you?
Mr. DUNBAR. Correct. And that is just—there is no consistent
method or message coming out from DOD on where to get things.
Even if you go to the CMMC-AB frequently-asked-questions page,
sometimes they say Oh, that is a DOD responsibility, and that has
been a lot of the kickback is pointing fingers between the CMMC-
AB and DOD saying, Well, they are responsible for X; they are re-
sponsible for Y.
Ms. VAN DUYNE. Specifically for the small business community,
I didn’t mean to cut you off, if you had anything else to add.
Mr. DUNBAR. No, ma’am.
Ms. VAN DUYNE. Specifically for the small business community,
and I hate to add another agency in here, but do you see a role
that SBA could possibly play in helping to be an intermediary be-
tween the three?
Mr. DUNBAR. I definitely—there should be a role for the SBA
in here. I don’t feel that the SBA has been able to be involved. I
feel that the DOD has sidelined them, at least in my opinion, in
the same manner that I think a lot of small businesses have been
ignored when we have raised questions or raised issues. And that
has basically been kept to a very small group of people that are
running all of this, and then we get told later on, Here is what is
happening.
Ms. VAN DUYNE. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentlelady’s time is expired.
And now I recognize the gentleman from Pennsylvania, Mr.
Evans, for 5 minutes.
Mr. EVANS. Thank you, Mr. Chairman. I would like to ask a
question to Ms. Wilson. Small businesses are frequently targeted
by cyber criminals. What would the ideal situation be for you in
terms of the Department of Defense ensuring that cybersecurity
taken care of its small business base?
Ms. WILSON. Thank you so much, sir. I think one simple solu-
tion to offer, and it could be reasonable cost and possibly free. It
is the offer of maybe cyber tools that are already approved by DOD
to the small business community as a first line of defense. It could
be offered up from the CMMC level one up to possibly level two.
And then, at least this way, DOD has a level of comfort to say,
Okay, at least we have some tool out there now, it is up to the mar-
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00018 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
15
ketplace, the small business community to go out and secure addi-
tional certification, if necessary, to ensure that, you know, at least
we are taken care of, and that shows an effort that the DOD cares.
That is a critical part. We just need to know that DOD is here to
help you.
Mr. EVANS. I would like to follow up. For many small business,
cybersecurity certification is just one of the many requirements of
certification they need to comply with as part of being a defense
contract. Can you mention just a few of the other certifications you
have to comply with, and how does the cybersecurity certification
compare to other certification in terms of its levels of burdens?
Ms. WILSON. Sure, sir. So for T47, we have actually invested in
securing the ISO certifications, three certifications. We are doing
that currently. That is a very costly investment. We will also have
the SBA 8(a) certification that is due annually. And because of our
size now, we now must incur additional cost for audits that are
necessary to keep the certification.
We have the woman-owned small business certification, and then
as a clear facility, we have the defense counterintelligence security
certifications as well to keep our clearance.
So, in comparison to all those other certifications was just a
small list for us. To be perfectly clear and frank with you, the
CMMC has been the most challenging, because it is just a lack of
not understanding exactly what is needed, and it is a cost that is
involved. There is no transparent cost set aside for, like, small
business mid or large.
And I know this is a new initiative because any time you roll out
a new policy, there is always going to be bumps in the road, but
at the same token, there needs to be more of a clear communication
from DOD, and those that are managing this process on what it is
going to take for small businesses, or all businesses to have the
certifications necessary.
And that is going to take a concerted effort for everyone to un-
derstand. CMMC, to be quite honest with you, it is new, but it is
a challenge. And it must be worked out pretty quick because you
are going to start rolling these things out into contracts, and the
fear could be real once it starts happening.
Mr. EVANS. I thank you.
And I yield back the balance of my time.
Thank you, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And now I recognize the Ranking Member of the Subcommittee
for Underserved, Agricultural, and Rural Business Development,
Mr. Hagedorn of Minnesota for 5 minutes.
Mr. HAGEDORN. Mr. Chairman, thank you for that, Ranking
Member Van Duyne. It is good to be with you today. Thanks to the
witnesses. This seems to be one of these issues, and even the big
agencies the Federal Government want to impose a lot of things on
small businesses that they themselves don’t handle appropriately.
It doesn’t take—you don’t have to think too long and hard to re-
alize that the DOD has lost technology outright, giving it away in
some cases, our Federal Government, to China. Economic tech-
nology, of course, gets lost a lot by big companies. OPM went and
took 25 million records of Federal employees. I was one of those
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
16
folks that they stole from during the Obama administration, and
now they come along and say, Well, if you want to do business with
us, you have to go through a bunch of gyrations, spend a bunch of
money, and some of it, it seems, could be reasonable.
You look at recently, we had some issues with, obviously—and
these things are very important. We had a big meat packing com-
pany that does 25 percent of the beef in the United States; have
a pork manufacturing plant in Worthington, Minnesota, where I
represent, they went down and you see how critical things can be.
We can lose our food supply and everything else in the blink of an
eye, but Mr. Dunbar, I think—wouldn’t it make more sense if the
Federal Government just imposed some reasonable standard and
said if you want to do business with us, you got to try to do every-
thing possible in order to make sure there is security here, and
that you protect these digital ways that you do business? I mean,
rather than have you go through all these hoops. I mean, you say
it costs up to $100,000, it doesn’t seem reasonable to me.
Mr. DUNBAR. Thank you, sir, for the question. Yes, I agree. I
think the keyword there is the definition of reasonable. I believe
the DOD believes that their numbers and that their requirements
are reasonable. Small businesses would probably disagree with
that when you have a company like mine of six people that has to
spend $100,000 to comply with something.
There are, as I mentioned, standards out there currently that are
being used every day. I mean, right now, a small business—you
walk into a small business and we hear advertisements on TV and
such saying, We have got your security, Have your internet service
through us, we got you covered. Well, that is what a small business
thinks. Okay. They got our security for us. No problem. Then we
see something like this and say, Well, we really don’t have security,
do we? We need something in between those two items.
My security that I currently have in place is, as I mentioned, cov-
ers 77 of the items that are being requested in 90 percent of the
problems, and it is costing me about $15,000 a year to $20,000 a
year to do that. I could get away with a little bit less, but I have
insurance and other things on it that get tossed into there to cover
in case I get hacked.
So there are standards out there that could cover reasonably well
what we are all looking for, and meet a level, I think, that would
provide security for anything but the greatest items out there. As
was mentioned by Mr. Williams, having access into a system pro-
vided for us for companies that don’t need to take something or
machine it, but actually just need that data and that information
can go into the government system sort of like the National Guard
does. They have their little wall garden, we call it. A member of
the National Guard can go in, get their CUI information in there,
go out, be it their VPN, and now they have all the information that
they need, and it has been in a secure environment.
Mr. HAGEDORN. So I worked a little bit in the Treasury De-
partment, and I have seen bureaucracies in action and usually the
bureaucrats come up with lots of ideas in order to make sure that
if something goes wrong they can, as you say, point the finger at
somebody else. And I see a lot of that here. I see a lot of expense
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
17
being pushed along to you, and just because if something goes
wrong, they don’t want to be blamed for it.
And I think, you know, it is kind of telling when government
comes up with these ideas here, we are going to put this regulation
on you, we are going to make you do all these types of things, and
oh, it is going to cost some money so, well, now let’s go find funding
streams in order to help you pay for that. I mean, we see this all
day long.
I think a reasonable standard would make sense. Most busi-
nesses, even the big ones, have issues here. They all need to do bet-
ter in compliance and I think that people can figure that out. So
thanks very much, by the way, for your service to the country and
you had a very impressive resume. Took our Ranking Member an
extra shot at it just to get it out.
Thanks very much.
Mr. DUNBAR. Thank you, sir.
Chairman PHILLIPS. The gentleman yields back.
And now we recognize the Ranking Member of the Subcommittee
on Economic Growth, Tax, and Capital Access, Mr. Meuser, for 5
minutes.
Mr. MEUSER. Well, thank you, Mr. Chairman. Thank the Rank-
ing Member very much for holding this hearing. Thank you to the
witnesses as well. So there are reports—we all know that cyberse-
curity is clearly an issue. Reports are, that I have reviewed, that
6 percent of U.S. military and aerospace contractors reported data
breaches between 2016 and 2018. Ransomware attacks are up over
100 percent in 2020. All industries, by the way. That is for all in-
dustries. So it is a concern.
DOD, however, seems to have created the CMMC mandates that
are a major concern to all small businesses and contractors cer-
tainly sitting here, and in my district. In fact, it seems that some
of the focus on compliance with these mandates is even truncating
your actual ability to focus on actual cybersecurity. And as being
in business for a lot of years, I understand that. These mandates
coming from Washington, in this case the Department of Defense,
don’t take what your business about fully into consideration. How
could they possibly, right? I mean, it is a one-size-fits-all approach.
So, I am definitely not happy to hear that the Department of De-
fense is also not offering forums to have this discussion with you,
right? Perhaps in a hearing maybe we can do that or create access
so they can better understand your concerns. And, again, I have
DOD suppliers in my district that have already, just in the last
couple of years, spent tens of thousands of dollars living up to these
requirements and trying to achieve them. And meanwhile, they
don’t necessarily even know what level they are at, and they are
very concerned, even their midlevel suppliers of those who are sup-
plying them, being able to maintain those costs. Everything that
you are discussing sharing here.
So Mr. Dunbar, I will just ask you this: Level one, we are talking
about level one here, what is—do we have the Department of De-
fense’s feedback on if level one is satisfactory, and for how long it
will be because I know they are trying to roll into this with a—in
a managed way over the next several years, right?
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00021 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
18
So what do they say about you and suppliers that you know
about maintaining level one at this point?
Mr. DUNBAR. Well, I think you reached part of the problem, is
we are not really hearing a lot. We have got some estimated dollars
and some numbers out there tossed around to level one, and yet
how long is it supposed to last, any of the real detail on it? We
don’t get a lot of that. As you mentioned, the technology, is that
going to keep up, or are we going to keep chasing technology as we
go along, and, therefore, chasing more regulations and more rules
that we have to get reassessed for along the way which are just
going to continue to increase costs?
Mr. MEUSER. Speaking of cost, what is the cost difference,
would you estimate, from level one, which many are saying here
they believe would secure your systems and your companies versus
say level three? Can you put a number on that?
Mr. DUNBAR. Easily ten- to twenty-fold.
Mr. MEUSER. Wow. Okay. And how much more secure would it
be from level one to level three?
Mr. DUNBAR. I don’t really know specifically from a level one
to level three how much more secure it would be. I know from
where I am currently, and what I am paying for the setup I have,
which is a pretty secure setup, according to—the person who han-
dles my security is actually a past director at DCISC for the De-
partment of Defense, so he is the one who set mine up, and he is
the one who said that we have 77 of the 120 controls and have 90
to 95 percent of the issues.
So he believes for very small companies that you could be looking
at, you know, 5 to 10,000 a year maybe for your costs instead of,
you know, having to reach up to this level and that same company
could be at hundred-plus thousand dollars a year.
Mr. MEUSER. Well, I think we can conclude that these meas-
ures are overly harsh and we do need to create a forum to have
this discussion with DOD so we can work this out.
I yield back, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And that completes our first round of questioning. So, therefore,
I will recognize myself for another 5 minutes.
Mr. Singer, while companies like yours in the pipeline become ac-
credited C3PAOs, there is a long ways to go until we have a sub-
stantial amount of them. So how likely is full implementation of
CMMC by 2026, if there is a lack of assessors?
Mr. Singer?
Mr. SINGER. I forgot to unmute.
Thanks for the question, sir.
I think it is very difficult to get there with the current progress
we are making. We have a hundred provisional assessors at this
time, and we have two C3PAOs already through the process from
doing a DOD assessment. And, by the way, the third-party asses-
sors are going through that level three assessment, so we have to
meet the 130 different practices.
So I think it is very difficult. The timeline is very stretched. As
I had said in my testimony, I think we need more than 8,000 as-
sessment team members to even make this happen, and that would
be starting from today. So the math just doesn’t work. I believe
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00022 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
19
that there does need to be some flexibility in how we are rolling
this out to the third-party assessors, and we need to have some—
you know, if we are going to try and meet that deadline, there
needs to be quite a bit more flexibility by the DOD in trying to
ramp this up and move this out.
I also feel pretty strongly that not everybody, as we have talked
about before, needs to be at level three. If you are a part compo-
nent maker, a small business, and you are doing, you know, special
processes like coatings, painting, and somebody—a prime flows
down a drawing to you and tells you, Put the label plate here on
this, you know, equipment, all of a sudden you have now had to
hit level three.
So there is some work here that needs to be done on under-
standing the risk truly to the supply chain, and maybe a single
part maker of a bracket doesn’t need to be level three, but some-
body that is making sub assemblies and more complex parts does
need to be.
So that would be my answer.
Chairman PHILLIPS. Thank you, sir.
And, Mr. Williams, while CMMC is a DOD initiative, we are be-
ginning to see it in other solicitations, particularly for government-
wide contracts like GSA’s 8(a) STARS III contract. So how con-
cerned should small businesses be of the CMMC Initiative being
adopted by civilian agencies and becoming a de facto baseline for
doing business with the Federal Government?
Mr. WILLIAMS. Yes, I think that is certainly a possibility. You
know, the rollout with CMMC at DOD has experienced challenges,
as we have been covering in today’s hearing, and I think it remains
to be seen if they will hit the target of 2026 as Mr. Singer just said.
I would view what is happening at DOD as a trial balloon. And if
it went well at DOD, which certainly is an open question at this
point, I wouldn’t be surprised at all if it is expanded beyond DOD
to all of government.
Chairman PHILLIPS. All right. Thank you, sir.
And with that, I will now yield to Ms. Van Duyne for 5 minutes.
Ms. VAN DUYNE. Thank you very much.
Mr. Singer, I appreciate your testimony here today. I just have
a couple of questions.
What is the penalty or the outcome for a small business that
can’t comply with the requirements?
Mr. SINGER. Today, the penalty is that you are out of doing
business with the DOD, period.
Ms. VAN DUYNE. Okay. I mean, that is—I am seeing Mr. Dun-
bar shake his head as well.
So I am going to ask actually the whole panel, can you point to
one or two concrete things that we can do to make understanding
these flow-down requirements easier for small business? Mr.
Hagedorn had a great point, well, yes, we could just define reason-
able and move forward from there. Can we be a little bit more spe-
cific on what you would need?
And, Mr. Singer, we will go ahead and start with you.
Mr. SINGER. Sure. Thanks for the question.
I think it is really—I think the primes really need to step up and
play a bigger role here. They have the resources and the teams,
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00023 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
20
and they have done a lot of the background work on understanding
what is required. And instead of just sending out a rep and certs
or a letter to a small business saying you need to post a score in
the supplier performance risk system, I think there needs to be
more support and help for them and more of a guiding kind of proc-
ess program that they implement for their whole supply chain to
help them get compliant.
Ms. VAN DUYNE. Ms. Wilson, do you have anything to add?
Ms. WILSON. Yes, ma’am.
To ensure that everyone is on the same page and have the same
information. What we have right now is pockets of information
going to various individuals, like I just heard from Mr. Dunbar,
said most of the information is being flowed through LinkedIn.
Some companies have LinkedIn and some companies do not. There
needs to be concerted effort of communicating what the standards
will be, what the costs will be across all industry, and filter down
to the small business, and maybe a regional approach to be able
to help understand that CMMC is here to stay, take away the fear,
but communicate clearly what it really means to have this certifi-
cation.
Ms. VAN DUYNE. Awesome. Thank you.
Mr. Williams?
Mr. WILLIAMS. Thank you.
Yes, I would like to make two points. First to address the com-
ment about flow down. The interim DFARS clause for CMMC
which was issued late last year directs prime contractors to flow
down the CMMC level that is appropriate for the information that
is being flowed down to the subcontractor. That gives a lot of dis-
cretion to the prime contractor to decide what is appropriate. I
would like to see the final DFARS clause for CMMC prohibit prime
contractors from flowing down a higher level than is absolutely
necessary based on the information that is being provided to the
subcontractor.
And the second point I would like to make about the information
that is being disseminated to the small business community, my
experience has been that there have been town halls, as Mr. Dun-
bar mentioned, and I get the LinkedIn messages as well. There are
other ways that information is being pushed out, but I think the
problem—the challenge is that that messaging is blunted by the
fact that we still have no answers for many of the critical ques-
tions.
So rather than focusing on creating more forums for dissemi-
nating information, I think we need to focus on providing real hard
information about how much this is going to cost and when are
small businesses going to need it, what level are they going to
need? Until we can answer those basic questions, I think, you
know, the forums are going to be largely lost on the small business
community.
Ms. VAN DUYNE. Thank you very much, Mr. Williams.
Mr. Dunbar, did you have anything to add?
Mr. DUNBAR. Yes. One of the items with small business is a lot
of small businesses work from, I will say remote locations. You may
have an office where you have people working from home, several
people at various homes. One of the big items that was brought up
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00024 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
21
recently by one of the board members for the CMMC was that we
will be subject to home inspections in order to pass CMMC.
So now you have people doing home inspections in your own pri-
vate homes. The risks beyond that on there are just, you know, in-
calculable.
Another item to me that really piqued my interest there was our
ability to protect ourselves during an assessment. Right now, an
answer on the Board FAQ site basically states that an RP that
helped us go ahead and put together our plan is not to be there
to defend our plan. So if we get—you know, fail it, we are supposed
to know this book again. We don’t have an expert to know it.
Ms. VAN DUYNE. Excellent. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentlelady yields back.
And now I recognize the gentleman from Pennsylvania, Mr.
Evans, for 5 minutes.
Mr. EVANS. Thank you, Mr. Chairman.
Mr. Dunbar, what would you—what would be your recommenda-
tions for those businesses that are just learning about the Initia-
tive? I would like to ask all of the panel that question.
I will start off with you, Mr. Dunbar.
Mr. DUNBAR. I honestly don’t know that I have an answer for
that, because trying to know find the information, it has not been
clear enough to everybody where to get it. If I am getting it from
LinkedIn, I mean, I first heard about it at an Army Corps Small
Business Conference in 2019. Otherwise, I may not even know
about it today.
Mr. EVANS. Does any other panel—any comments or thoughts
on that, any of the other panelists?
Mr. SINGER. Sure, sir, I would like to make a comment.
You know, I think one of the important things is for companies
to find reputable businesses to help support them through this
process, and, unfortunately, I think there is too much variation in
the help that they are getting, as Ms. Wilson spoke of earlier also.
I think also that, especially now, I think a lot of the level three
companies are aware of this coming down, especially small manu-
facturers that are, you know, just now starting to really under-
stand this because the letters are coming out from the primes.
But I think a big gap is the people that are going to have to meet
level one and they don’t know it right now, and I think that should
be a much more proactive reach-out to those folks. I mean, the
DOD knows who they are contracting with in these areas, and I
think they should take a more active role.
Mr. WILLIAMS. Yes, Representative Evans, if I could just back
up Mr. Singer’s comments there, our primary recommendation to
our small business clients is to get level one ready. The level one
requirements really are basic things, like antivirus software and
spam filters that we think all companies should be doing, regard-
less of whether you work with the Federal Government. In this day
and age, you should be doing at least those basic requirements, and
they are already in the FAR. The FAR requires these basic safe-
guards. That has been the requirement for a long time.
So, this really, frankly, shouldn’t be surprising, but I totally rec-
ognize that it is, because small businesses have so much to focus
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00025 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
22
on. But these requirements are not new, and they are, generally
speaking, not difficult to obtain for small businesses. So, we would
like everyone to really focus on at least getting level one ready, be-
cause these are things you should be doing as a business.
Ms. WILSON. And I would echo everyone’s comment that has
been made on the panel. I do make a concerted effort to share with
small business owners to mention CMMC, and I mention it in the
context of the necessary need for them to actually have it, but un-
derstand what it means and the implications, because right now,
we just have black and white implications of saying if you don’t
have it, and your contract comes up for renewal, then you run the
risk of losing your contract.
And, so, putting that fear in them early on, maybe prompt them
to move forward. But also I think from our perspective at T47, we
have already proactively tried to secure something similar, certifi-
cation. It may not be directly related, but to at least get us ready
so that way when it comes down for us to have an audit, we are
in a position to actually, pass the audit.
So it is a challenge, and right now, because we don’t have cohe-
siveness of information, it makes it a little more difficult for small
businesses that just now are recognizing that they need it, or they
know they need it but don’t know how to secure it.
Mr. EVANS. I yield back, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And now I recognize the gentleman from Wisconsin, Mr. Fitz-
gerald, for 5 minutes.
Mr. FITZGERALD. Thank you, Mr. Chair.
I am going to start, Mr. Singer, as a fellow Wisconsinite, I have
quite a bit of experience in working with obviously anywhere from
major corporations down to, you know, one and two person Ma &
Pa shops. But my question, I was talking a little bit to staff about
this yesterday. We were kind of kicking around the idea that there
might be a different level of security from State to State through-
out the Nation, and I just wanted to get maybe your perceptions
on, is there much interaction with the State of Wisconsin from your
perspective? And if there are, what are the influences there? Be-
cause I think it would be valuable for Members of Congress to
know kind of what is going on at the State level.
Mr. SINGER. Thank you, sir.
As a fellow Wisconsinite, it has been kind of fun starting a busi-
ness in Wisconsin, and Minnesota too. But as far as—I haven’t had
a lot of interaction with the State government. I counseled them a
little bit on CMMC. It has been new to them, in helping them to
try and understand the issues around this for small business.
One of the organizations that we work very closely with are the
MEPs, the Manufacturing Extension Partnership programs. Every
State has one. There is—and Puerto Rico has one. We have been
working very closely with them to try and help get the small manu-
facturers in Wisconsin and Minnesota through the assessment so
that they can accept awards from the primes.
So I think that is really actually a good avenue to help small
businesses is through the MEPs, especially the manufacturers. But
I don’t know that, you know, the States yet have really kind of fig-
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00026 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
23
ured out any good mechanisms to help fund or support the small
businesses as of yet.
Mr. FITZGERALD. Very good. Thank you.
As anybody could probably answer this question, let me just di-
rect it to Mr. Dunbar, though. And I apologize if some version of
this was asked earlier. But cybersecurity, obviously, you can be a
consultant, quote/unquote ‘‘consultant,’’ and I am wondering if you
are seeing, because we are starting to hear that there are many
different versions of this, and obviously many different levels of
professionalism and knowledge.
And I am just wondering if you could comment kind of, you know
what is your take, kind of what is going on out there on the street?
Mr. DUNBAR. Thank you, sir.
Yes, you are 100 percent correct. There is a large fear in the
small business community that the ‘‘consultants,’’ in quotations,
are not all equal. I get inundated with emails daily from companies
trying to convince me that I am not ready, I need to be—I am los-
ing my contracts. I mean, blatant lies in your inbox constantly from
companies. I call it the fear marketing.
I have also seen things from—as one of the other members of the
committee had mentioned earlier, you know, companies that—there
are fraudulent companies out there, just that have no business.
There was one, I think, the College of India was creating, We can
get you CMMC certified.
Mr. FITZGERALD. Right.
Mr. DUNBAR. Like, okay, great. How is the College of India get-
ting me CMMC certified? And that is a fear. We don’t know where
to go. We have been told, Oh, well, the only great place, the only
authorized place is the CMMC-AB, if they are on their market-
place, that is the only place to get, that is legal, to get your con-
sulting from. That is a whole separate issue, I believe.
Mr. FITZGERALD. Yes. And, you know, to dovetail on that, so
compliance, too, because it is kind of wide open as to what the cost
could be associated with that. You know, you hear figures thrown
around, like, Well, it costs a company $10,000 to comply, or it costs
them $1 million to comply. That is not necessarily a good gauge,
I don’t think, on, kind of, you know, whether or not somebody is
a legitimate consultant. But it sounds like that is kind of the range
that is out there when a lot of these small businesses are consid-
ering how to become not only compliant, but protect ourselves,
so——
Mr. DUNBAR. And I think you raise a good point because there
is also a lot of companies out there trying to sell one-stop shopping,
like, Oh, we have this program. You buy this program, you are
CMMC-compliant.
Mr. FITZGERALD. Right.
Mr. DUNBAR. And that is not going to happen.
Mr. FITZGERALD. Yes. Very good. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentleman yields back, and that com-
pletes our questioning.
So I will move to my closing statement. And I want to thank all
of our witnesses for a very compelling testimony today and for illu-
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
24
minating the very issues that small contracting firms are experi-
encing as they try to bolster their cybersecurity.
Recent high-profile attacks have made it very clear that the
threat of malicious cyber actors is growing, and that is why we
must ensure that companies in the DIB are prepared for all cyber
threats that might come their way. But it is equally vital, equally
vital that we do not deprive businesses like yours of critical oppor-
tunities in that process.
We have got to work as a committee to increase cybersecurity
preparedness across the DIB in a way that is not cost prohibitive
to small firms. By achieving this, the small businesses will still
have ample access to a lucrative marketplace while also protecting
themselves against 21st century threats.
I would ask unanimous consent that members have 5 legislative
days to submit statements and supporting materials for the record.
Without objection, so ordered.
And if there is no further business to come before the committee,
we are now adjourned.
Thank you.
[Whereupon, at 11:17 a.m., the subcommittee was adjourned.]
SBD026 with DISTILLER
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00028 Fmt 6633 Sfmt 6633 F:\DOCS\44926.TXT DEBBIE
25
APPENDIX
SBD026 with DISTILLER Insert offset folio 25 here 44926.001
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00029 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
26
SBD026 with DISTILLER Insert offset folio 26 here 44926.002
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00030 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
27
SBD026 with DISTILLER Insert offset folio 27 here 44926.003
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00031 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
28
SBD026 with DISTILLER Insert offset folio 28 here 44926.004
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00032 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
29
SBD026 with DISTILLER Insert offset folio 29 here 44926.005
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00033 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
30
SBD026 with DISTILLER Insert offset folio 30 here 44926.006
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00034 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
31
SBD026 with DISTILLER Insert offset folio 31 here 44926.007
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00035 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
32
SBD026 with DISTILLER Insert offset folio 32 here 44926.008
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00036 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
33
SBD026 with DISTILLER Insert offset folio 33 here 44926.009
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00037 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
34
SBD026 with DISTILLER Insert offset folio 34 here 44926.010
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00038 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
35
SBD026 with DISTILLER Insert offset folio 35 here 44926.011
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00039 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
36
SBD026 with DISTILLER Insert offset folio 36 here 44926.012
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00040 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
37
SBD026 with DISTILLER Insert offset folio 37 here 44926.013
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00041 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
38
SBD026 with DISTILLER Insert offset folio 38 here 44926.014
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00042 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
39
SBD026 with DISTILLER Insert offset folio 39 here 44926.015
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00043 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
40
SBD026 with DISTILLER Insert offset folio 40 here 44926.016
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00044 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
41
SBD026 with DISTILLER Insert offset folio 41 here 44926.017
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00045 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
42
SBD026 with DISTILLER Insert offset folio 42 here 44926.018
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00046 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
43
SBD026 with DISTILLER Insert offset folio 43 here 44926.019
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00047 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
44
SBD026 with DISTILLER Insert offset folio 44 here 44926.020
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00048 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
45
SBD026 with DISTILLER Insert offset folio 45 here 44926.021
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00049 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
46
SBD026 with DISTILLER Insert offset folio 46 here 44926.022
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00050 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
47
SBD026 with DISTILLER Insert offset folio 47 here 44926.023
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00051 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
48
SBD026 with DISTILLER Insert offset folio 48 here 44926.024
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00052 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
49
SBD026 with DISTILLER Insert offset folio 49 here 44926.025
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00053 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
50
SBD026 with DISTILLER Insert offset folio 50 here 44926.026
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00054 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
51
SBD026 with DISTILLER Insert offset folio 51 here 44926.027
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00055 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
52
SBD026 with DISTILLER Insert offset folio 52 here 44926.028
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00056 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
53
SBD026 with DISTILLER Insert offset folio 53 here 44926.029
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00057 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
54
SBD026 with DISTILLER Insert offset folio 54 here 44926.030
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00058 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
55
SBD026 with DISTILLER Insert offset folio 55 here 44926.031
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00059 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
56
SBD026 with DISTILLER Insert offset folio 56 here 44926.032
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00060 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
57
SBD026 with DISTILLER Insert offset folio 57 here 44926.033
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00061 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
58
SBD026 with DISTILLER Insert offset folio 58 here 44926.034
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00062 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
59
SBD026 with DISTILLER Insert offset folio 59 here 44926.035
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00063 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
60
SBD026 with DISTILLER Insert offset folio 60 here 44926.036
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00064 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
61
SBD026 with DISTILLER Insert offset folio 61 here 44926.037
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00065 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
62
SBD026 with DISTILLER Insert offset folio 62 here 44926.038
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00066 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
63
SBD026 with DISTILLER Insert offset folio 63 here 44926.039
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00067 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
64
SBD026 with DISTILLER Insert offset folio 64 here 44926.040
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00068 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
65
SBD026 with DISTILLER Insert offset folio 65 here 44926.041
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00069 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
66
SBD026 with DISTILLER Insert offset folio 66 here 44926.042
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00070 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
67
SBD026 with DISTILLER Insert offset folio 67 here 44926.043
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00071 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
68
SBD026 with DISTILLER Insert offset folio 68 here 44926.044
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00072 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
69
SBD026 with DISTILLER Insert offset folio 69 here 44926.045
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00073 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
70
SBD026 with DISTILLER Insert offset folio 70 here 44926.046
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00074 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
71
SBD026 with DISTILLER Insert offset folio 71 here 44926.047
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00075 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
72
SBD026 with DISTILLER Insert offset folio 72 here 44926.048
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00076 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
73
SBD026 with DISTILLER Insert offset folio 73 here 44926.049
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00077 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
74
SBD026 with DISTILLER Insert offset folio 74 here 44926.050
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00078 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
75
SBD026 with DISTILLER Insert offset folio 75 here 44926.051
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00079 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
76
SBD026 with DISTILLER Insert offset folio 76 here 44926.052
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00080 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
77
SBD026 with DISTILLER Insert offset folio 77 here 44926.053
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00081 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
78
SBD026 with DISTILLER Insert offset folio 78 here 44926.054
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00082 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
79
SBD026 with DISTILLER Insert offset folio 79 here 44926.055
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00083 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
80
SBD026 with DISTILLER Insert offset folio 80 here 44926.056
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00084 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
81
SBD026 with DISTILLER Insert offset folio 81 here 44926.057
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00085 Fmt 6602 Sfmt 6602 F:\DOCS\44926.TXT DEBBIE
82
Æ
SBD026 with DISTILLER Insert offset folio 82 here 44926.058
VerDate Mar 15 2010 15:12 Sep 22, 2021 Jkt 000000 PO 00000 Frm 00086 Fmt 6602 Sfmt 6011 F:\DOCS\44926.TXT DEBBIE
File and source
- File
- CHRG-117hhrg44926.pdf
- Size
- 56,420,143 bytes
- SHA-256
- 3e81bd1246a10bf31ff5de99618b334714108a25ca02a3bbd6711423d6298acf
- Our copy
- CHRG-117hhrg44926.pdf
- Original
- www.govinfo.gov