We Need to Go That Way!

There are currently about 65,000 defense contractors and sub-contractors. This number grows to over 300,000 when you include vendors.  In a 2018 survey of these contractors, nearly 45% indicated they had not even read the NIST 800-171 requirements and less than 1% were self-certified.  It has become obvious that how we protect sensitive data was going to have to change from voluntary to mandatory.  The unchecked flow of CUI (or CUI not marked as CUI!) over the internet continues to expand and critical technologies are, or already have been, compromised.  As an example, leveraging large amounts of data published in open source and available on the internet, China was able to build their first large aircraft carrier that mirrors U. S. technology (Figure 1).  In addition, China has built Tactical Aircraft similar to the F-35 also based on open source data.  In reality, most of these data should have been marked as CUI, but identifying what is CUI and what is not is also a challenge!  The CUI data that is in open source has compromised the United States edge in technology.  We have to stop the bleeding and CMMC will help in this endeavor.  CMMC lays that framework out.

Another challenge is to have CMMC embraced by all in the DIB and enculturate it across the industry.  Of course, making it a part of the requirements set forth in an RFP will help expedite the process, but everyone in the DIB needs to want to do this expeditiously to protect our national intellectual property.  Think about it.  Even if CMMC was not a requirement, what would happen to your company if it was determined that a CUI breach occurred through your negligence?  What if you were to lose your Intellectual Property because you failed to apply basic security controls?  You will almost certainly lose your reputation, a lot of money and possibly your business altogether (60% of all small businesses go out of business within 6 months after a security breach).  By the end of 2020, CMMC will have taken root across the DIB and it is up to all of us to make it a success, not only for National Security but also for your protection!

CMMC is here to stay.  It is not voluntary.  However, you can voluntarily make yourself non-competitive on future DoD contracts if you choose to ignore the requirements.  Do not go this way.  Get started, get audited, get certified and compete.  Go THAT way!  Not just because it is a requirement, but also because we all want to protect our technology, our data, our intellectual property and our Nation.