Blog

CMMC Q&A: Cybersecurity Requirements for DoD Contractors

October 25, 2022 By

Cybersecurity Maturity Model Certification (CMMC) is a framework of various cybersecurity standards and best practices to safeguard sensitive national security information from increasingly frequent and complex attacks. CMMC 2.0 compliance is a requirement for all government contractors working with the Department of Defense (DoD).

In 2015, the DoD released the Defense Federal Acquisition Regulation Supplement (DFARS), a series of cybersecurity requirements contractors and subcontractors in the Defense Industrial Base (DIB) had to follow to protect Controlled Unclassified Information (CUI). As part of the certification process, it includes complying with the National Institute of Standard and Technology (NIST) Special Publication (SP) 800-171 Revision 2 (NIST SP 800-171 R2).

Contractors will lose existing DoD contracts and won’t be able to bid for new ones until they can demonstrate compliance with the required level in the contract. The Department of Justice (DOJ) has also launched the Civil Cyber-Fraud Initiative, which will utilize the False Claims Act to pursue cybersecurity-related fraud by government contractors and grant recipients who falsely claim compliance.

What are the CMMC Requirements?

In 2020, the Department of Defense (DoD) began to demand a self-assessment using a points-based system to prove compliance from defense contractors – an honor system, if you will. After completing the self-assessment, contractors are required to submit their scores to the DoD’s Supplier Performance Risk System (SPRS). A System Security Plan (SSP) is also required, containing comprehensive details of the organization’s networks, systems, processes, policies and security controls including how those controls are being implemented and improved over time. Contractors must currently have a SPRS score listed in the SPRS database in order to bid and receive DoD contracts.

In a significant move, the DoD introduced the Plan of Actions and Milestones (POAM) where organizations who have not yet fully implemented 800-171 can submit a solid plan for achieving full compliance, with specific dates and a timeline. This POAM is submitted with the SPRS and enables organizations to begin working for federal agencies whilst they simultaneously work towards full implementation of 800-171. Once CMMC is fully implemented, the timeline for completing a POAM is six-months from submission of a SPRS score and POAM.

Companies that handle CUI must also submit to and pass an independent audit proving that they meet the 110 controls outlined in NIST 800-171 R2. This audit is at the company’s expense.

When will CMMC Certification be required?

Mandatory SPRS score reporting has already begun in order to bid for contracts (to include creation of an SSP and POAM). Voluntary audits of those who claim to be CMMC compliant began in August 2022. It is expected that all the requirements of CMMC will be finalized by end of first quarter 2023.

Who needs CMMC Certification?

CMMC is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors. According to the DOD, the CMMC requirements will affect over 300,000 organizations.

How will CMMC 2.0 be enforced?

Today, companies without a SPRS score cannot bid for new contracts. Those that can show compliance to CMMC Level 2 or 3 must submit to an audit by a third party. Failing the audit could result in loss of contracts or the ability to bid for future contracts. Any company that falsifies their compliance could face a False Claims Act lawsuit from the Department of Justice. The DOJ has already begun pursuing and collecting millions in fine from cases of cybersecurity-related fraud by government contractors and grant recipients.

What will be the consequences of not completing CMMC Certification?

Non-compliant companies will lose the ability to bid for new DoD contracts.

What are the different CMMC Levels?

You may be asking yourself, “What CMMC level do I need?” Determining the CMMC level you need depends on the type of services and information that your company accesses and stores in your information systems.

CMMC requirements are based on the type of information a company handles. Companies that provide COTS (Commercial off-the-shelf) service to the DoD and only handles Federal Contract Information (FCI) must comply with CMMC Level 1. All companies that handle CUI (Controlled Unclassified Information) must comply with Level 2 or 3 and have implemented 110(+) controls as well as prove successful implementation through an audit by an independent agency. For more details:

Level 1 (Foundational) only applies to companies that focus on the protection of FCI. Level 1 is based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.
Level 2 (Advanced) is for companies working with CUI. CMMC 2.0 Level 2 requirements mirror NIST SP 800-171 and aligns with the document’s 14 levels and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI.
Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on DoD’s highest priority programs. The DoD has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

In addition, Levels 2 and 3 will required a third-party assessment. See the chart below for an overview.

Are the CMMC requirements for small businesses the same as those for larger businesses?

CMMC requirements are not based on the size of the business but the type of information to which the company has access in order to do business with the DoD. Companies that only handle FCI (Federal Contract Information) do not have as stringent requirements as those who handle CUI (Controlled Unclassified Information).

How do I complete a CMMC Audit?

CMMC requires all DoD contractors that meet the requirements for Level 2 or 3 to get audited and obtain certification from a trusted and approved third-party assessment organization (C3PAO). For Level 2 compliance the CMMC Accreditation Body (CMMC-AB) is responsible for reviewing audits and issuing certificates, however C3PAO must perform an audit. For a small subset of contractors who must comply with Level 3, the federal government will conduct the audit.

The CMMC audit cost depends on the size of an organization. Notably, Companies should expect to incur the following types of costs in a CMMC audit process:

Audit preparation costs: Also referred to as soft costs, audit preparation costs are the expenses for preparation and external consultancy.
Hard costs: Hard costs are also incurred in audit preparation and the audit process and may involve investments made in processes needed to meet audit. This also includes costs for implementing authentication mechanisms, endpoint security, and log monitoring.

What is the total cost to get CMMC Certified?

There is no set cost to CMMC compliance. In addition, CMMC is not a “one and done” milestone. It will require time, personnel and expense to both achieve initial compliance and the work necessary to maintain compliance. CMMC Certification costs will vary by company depending on:

what level of compliance needs to be achieved,
where a company is in their current journey to CMMC compliance,
the types of controls that need to be purchased, installed, configured and in place to achieve compliance,
the cost of managed service providers (MSPs) and other vendors to perform installation and configuration of said controls,
the cost of maintaining systems and controls and
the cost of additional employees to maintain, update and manage the Risk Management, Policy and Procedure, Monitoring and Audit aspects of NIST 800-171 required to keep the company in compliance.

A good rule is that it will take most companies six to 12 months of time, talent and information system upgrades to gain compliance.

How long does it take to become CMMC Certified?

General estimates are six to twelve months to achieve compliance and certification.

How does CMMC compare to NIST 800-171?

NIST SP 800-171 lays out the requirements for any non-federal agency that handles controlled unclassified information (CUI), or other sensitive federal information. It details how organizations should protect this information. First published in 2015, the goal is to strengthen the federal supply chain and ultimately protect national security as a whole.

The “800-171”, as it’s known, is made up of 110 controls divided into 14 control families, and takes around half a year to implement. It’s important to note that there is no certification to prove compliance with this framework. It was originally developed to provide guidance to the DFARS clause (the Defense Federal Acquisition Regulation Supplement)- the original cybersecurity requirements from the DoD.

Since DFARS is still a listed requirement in most government contracts, if you are bidding on a contract or have been awarded the work, you’ll need to be compliant with all 110 NIST 800-171 controls in order to fulfill the DFARS clause.

Unfortunately, due to the lack of certification, the DoD found that contractors were claiming to uphold all of the NIST 800-171 standards, but in reality, they were not. DoD decided that it was necessary to develop a certification process to ensure that contractors were compliant with a basic set of cybersecurity controls: thus the CMMC and NIST 800-171.

How can GaMEP help my company become CMMC Compliant?

GaMEP can perform a CMMC Gap Analysis and Readiness Assessment. The gap analysis and readiness assessment are foundational steps for companies to gain a detailed understanding of how close they are to meeting the requirements of their targeted CMMC level.

The Readiness Assessment will help uncover systems and processes that may not meet the standards outlined in NIST 800-171, such as:

How is data stored and access to information controlled?
Are incident response plans in place, current, and effective?
Are IT staff and other personnel adequately trained?
How are security protocols implemented and maintained?

The resulting Gap Analysis will pinpoint risk areas for contractors and facilitate the creation and execution of the Remediation Plan, either by the MSP or utilizing in-house resources. From the Gap Analysis, GaMEP can assist a company with creating the SPRS, SSP and POAM necessary to begin the CMMC process and bid for DoD contracts.

Without an exhaustive Gap Analysis in hand, DoD contractors may find it impossible to identify risks, prioritize activities, and determine costs for any remedial steps required for CMMC certification.

What if I am not located in Georgia?

Check with your local state MEP to see if they can provide CMMC services.

Where can I complete CMMC training or learn more about CMMC requirements?

You can learn more about CMMC by contacting your GaMEP regional manager or by filling out the Contact Us form.

By: Michael Barker, GaMEP Cybersecurity Project Manager

Three Lean Office Exercises for Improving Front-office Processes

August 26, 2022 By

Recently, the GaMEP marketing and operations team participated in a lean office exercise to map out our data entry, event registration, and email marketing processes to find ways to reduce inefficiencies, integrate software systems, and improve our client experience. Are you interested in how lean tools could help your company’s front office systems? Below are a few examples of lean office exercises that could help your company eliminate redundant steps and non-value-added activity and empower employees to identify opportunities for continual improvement:

Swim Lane Diagram: When an administrative process takes too long, generates errors, or otherwise frustrates the users, the first step is often to get a cross-functional group of people in a room to map out the current state. This builds a common understanding of the full process and how different stakeholders contribute to it. A Swim Lane Diagram can clearly show the sequence of steps, the role of each person or function in the process, and where handoffs occur. This view of the current state is critical in designing countermeasures to improve quality, speed, and employee satisfaction.

Process Mapping Before Software Implementation: There is no shortage of excellent software products available for office applications, but knowing what you need from that software is critical for success. Mapping out the current process to show who uses what systems, how data is generated, shared, and modified, and what workarounds are in use can make choosing and adopting new software much more productive. If you don’t understand the current process and what improvements you need to make, your team is likely to be frustrated with the result.

Customer Discovery: Because they are often far removed from the end customer, administrative functions at a manufacturer can easily become inwardly focused. To combat this internal optimization, consider the mission of the organization and how the office staff helps contribute to that mission. Ask questions like, “Who is our customer? What value are we providing? How do we measure success? What do we need to improve?” Involving internal and external customers in the conversation about improvements your office needs to make can yield tough feedback, but it will focus your team’s efforts on the right targets.

Think one or more of these exercises could fit your team’s needs, but don’t know how or where to start? Register to attend the Lean Office & Administration course on October 20th, or contact your region manager for more information.

Reshoring Your Supply Chain: Starting Points for Small to Mid-Size Manufacturers

July 18, 2022 By

“Reshoring”, also known as onshoring, has never been a hotter buzzword, leaving many to ask what is reshoring and what could it mean for your business?

The definition of reshoring is “the practice of bringing manufacturing and services back to the U.S. from overseas”¹Reshoring as a supply chain initiative has been around for over a decade, but as ports are bottlenecked and transportation costs continue to climb, companies and customers are frustrated and beginning to see it as a more attractive option than ever before. Add in extended lead times and shortages in consumer products and you have what seems to be the foundation of a reshoring strategy.

Yet the thought of reshoring some or all of the supply chain for a small or mid-sized manufacturer who may already be struggling with limited resources can seem to be an overwhelming task. Conceptually, it makes sense. Reshoring can solve problems, mitigate risk, lower costs, provide a ‘greener’ solution, and even create jobs. Catching this vision, especially now, is easy, but putting a plan in place to achieve this goal may seem impossible.

One approach is to focus on a few key starting points to research and analyze the advantages and disadvantages of reshoring, while conserving your valuable resources and giving your team the information they need to make strategic decisions.

History

Go back to why the decision was made to move the supply chain offshore. Dust off the presentations and pull those old Excel files from the archives. Answer these questions:

What was it that drove this decision?
What has changed since the decision was made?
If you used current data with the same criteria, would the evaluation yield the same recommendation?
What have been the positive results of this move?
While recent challenges have magnified the disadvantages of offshoring, when was the offshore supply chain working well and why?
Are there reshoring disadvantages that should be evaluated?

There is a reason that reshoring wasn’t seriously considered until now, and you have to find that reason to make an informed decision.

Problem Statement and Solution

Once you understand why the supply chain went offshore in the first place, you must quantify the current problem, or problems, you are trying to solve. Reshoring cannot be a solution in search of a problem – that approach won’t be sustainable. This is where narrowing the focus to match your available resources becomes critical. Write a problem statement to help you discover:

Are there a handful of components that are driving the majority of your problems?
How will reshoring, specifically, address the problems and provide a more workable solution than the current supply chain?
Are there solutions other than reshoring that could also address these problems?

Focus on real, tangible issues and start small, otherwise your problem statement will become so large or general that it’s meaningless or unattainable.

Technology

Evaluate your current supply chain technology and determine how it can be leveraged to support reshoring.

The supply-chain industry has understood that it can no longer treat technology as an isolated service, i.e., as a means to an end. Technology will inevitably become the backbone of the supply-chain industry. ²

While this backbone will be critical to successful reshoring, the key to success is to keep it simple. Utilize what you have, while in parallel beginning to build a longer-term vision and supporting strategy.

Many small to mid-sized manufacturers have much of their supply-chain data in Excel files downloaded from an ERP system of some type. If that’s the case, build a visual of these siloed Excel databases and determine your starting point, then ask these questions:

Will the technology and data you are using to support offshore suppliers have to change in some way to provide the supply chain visibility you need for reshoring?
Can you leverage the suppliers’ technology and/or integrate it with yours easily?
What benefits would there be to implementing new technology?
Does your team have the bandwidth to take on a new technology implementation right now?

Analytics

Make sure you are measuring apples to apples as you evaluate costs. If your analytics have not evolved over time to keep up with global supply chain evolution, this needs to be addressed before any final recommendations regarding the solution to your current supply chain problems can be made. In this regard, evaluating these questions can help get you started:

How are you measuring your supply chain?
Are you considering all parts of the landed cost equation?
Are you factoring in cost predictability, possible import tariffs, carbon offset costs, or what you may have to spend to react to a late or cancelled delivery?

Take a big picture approach to evaluating costs for both onshoring and offshoring. While you can’t necessarily predict future unknown costs or disruptions, you can account for possible or likely risks and weigh them as part of the overall equation.

Management and Team

Assess your overall supply chain management and team bandwidth, strengths, and weaknesses. This is in many respects no different than any other organization-wide project that you may pursue: it’s the team on the ground that will have to make it happen and change management will likely be a significant part of the overall project.

As noted in Supply Chain Management Review: Supply chain and business leaders must model High Performing Organization (HPO) culture, not only embracing new behaviors like adaptability, emotional intelligence and diplomacy, but also abandoning leadership behaviors that reduce employee engagement, inclusion and empowerment. Leadership must anticipate the resources employees need and make them feel safe to openly discuss mistakes and lessons learned to encourage smart risk-taking and agility.³

Consequently, you will need to ask questions like:

What is your supply chain management organizational structure and how would it need to change with reshoring?
Does your team have the resources they need to establish new suppliers and ensure these suppliers’ success?
Is your current team environment one in which the challenges of major supply chain changes can be openly discussed, measured, and acted upon?

As you determine the role your team will play in your new supply chain ecosystem, be sure to consider potential partnerships with suppliers. Partnerships can effectively expand your own team in addition to providing a real-time link to your most critical suppliers.

Completing your reshoring plan will require far more work than the starting points listed above but the initiative may have substantial benefits that help your company achieve long-term success. If you are struggling with how to make the leap from vision to project, these key points can help kick-off the process and give you the information you need to start a reshoring project.

With project managers located within two hours of any manufacturing plant in Georgia, the Georgia Manufacturing Extension Partnership at Georgia Tech, can help you locate the suppliers you need to reshore, assess the ability of your organization to support a reshoring strategy, and advise you on your analytics and technology. Contact us for more information on supply chain services or help with other aspects of your business.

¹www.reshorenow.org

² “Supply Chain Trends to Watch – 2021”, www.sourcingandsupplychain.com

³ “Developing High Performance Leadership”, Supply Chain Management Review, www.scmr.com

By: Dean Hettenbach, Project Manager, Georgia Manufacturing Extension Partnership

Hear Me Out: Creating and Maintaining a Safe Place to Work

February 16, 2022 By

This is a guest post from our partner, the Georgia Tech Safety, Health, Environmental Services (SHES) program.

Every year approximately 30 million workers experience hazardous noise exposure on the job. Over 9 million are at risk for severe hearing loss from occupational exposure to noise, which remains a persistent cause of employee illness in the workplace, and can even put you at risk for heart disease.

Noise-induced hearing loss is one of the most common occupational diseases and is the second most self-reported occupational illness or injury.*

Many manufacturing processes, machinery, and equipment produce high noise levels, which can lead to hearing problems. For reference, a normal conversation is typically about 60 dB, cars and trucks range around 70 to 90 dB, and sirens and airplanes can reach 120 dB or more. Anything over 70-80 dB is considered unhealthy.

Estimates suggest that roughly a third of people in Europe and the US are regularly exposed to unhealthy levels of noise, and numerous studies link chronic exposure to environmental noise like traffic and airplanes to a greater risk of high cholesterol, elevated blood pressure, and increased stress.+

Providing proper Personal Protective Equipment (PPE) and worksite health and wellness programs that target noise-exposed workers are several ways you can help employees feel safer. However, manufacturers also need to make sure their company complies with the OSHA regulation for noise hazards to maintain a safe working environment and avoid paying heavy penalties for serious violations.

Here are three ways that we can help identify and manage potential hazards within your facility:

Get Educated – Register for our Introduction to Noise Evaluation and Control Course offered several times a year in-person or online as a self-guided class with live office hours.
Be Proactive – Schedule a Free Safety Consultation with our experts. We will conduct noise monitoring at your facility to determine what actions are needed to protect your employees and keep you in compliance with the OSHA regulation.
Think Long Term – Whether you are creating a safety plan, scaling up production or reassessing the plant floor layout, utilizing the 5s and 6s principles of Sort, Set in Order, Shine, Standardize, and Sustain (and Safety), you can strategically turn work areas into clean, organized, and safe spaces.

To learn more about our safety training and services for manufacturers visit the SHES website at oshainfo.gatech.edu and sign up for our Quarterly Newsletter.

*Us, Department of Labor, Occupational Safety and Health Administration, OSHA Regional Instruction, Regional Emphasis Program (REP) for Noise Hazards, 2019

+Hansen, C., 2021, Why noise pollution is bad for your heart, https://www.bbc.com/future/article/20210315-why-noise-pollution-is-bad-for-your-heart

Get Your Strategic Plan Off the Shelf: Plan Deployment and Management

January 11, 2022 By

Strategic Planning is a powerful tool that can help companies define and meet both their short- and long-term goals. However, when we talk to companies about strategic planning, too often we hear, “We tried that, and it didn’t work.” Many companies develop a plan, only to see it collect dust on a shelf or in a filing cabinet. This often results in frustration and a negative opinion regarding the value of strategic planning.

The truth is that building a strategic plan is only half the battle in reaching your strategic goals. Effective deployment and management of a strategic plan allow you to get that plan off the shelf and use it in a practical way to guide daily activities. It will also help you say “no” to distractions that consume valuable resources and don’t support your long-term goals.

Strategic Plan Deployment

To achieve long-term success, it is critical to put the plan into action in a way that includes clear communication, employee participation, and traceable metrics to monitor progress and make adjustments. These proven elements are critical to successful deployment of a strategic plan:

1. Communication: Companies thrive when leaders build trust, practice proactive communication, and address the personal and practical needs of their team. This takes hard work, but the payoffs are well worth the effort.

2. Organizational Alignment: Successful plan deployment requires more listening than telling. To achieve group commitment and alignment with strategic goals, employees must be encouraged to actively participate in aligning their daily work with the strategic goals of the organization.

Many leaders attempt to simultaneously facilitate and participate in the strategic planning process. Our experience is that this approach limits team buy-in and commitment to the plan and commonly undermines the entire well-intentioned process. Consider an outside planning facilitator, such as GaMEP, to help you achieve the best results. As an alternative, appoint a team member who is not the most senior leader to facilitate the process.

Companies demonstrate organizational alignment when they can answer “yes” to the following:

Can the leadership team describe the mental models for the desired future state of the organization?
Do everyday decisions and actions support strategic priorities?
Does everyone in the organization know and understand the company’s vision and how their work contributes to reaching the desired future state?

“If you could get all the people in an organization rowing in the same direction, you could dominate any industry, in any market, against any competition, at any time.” – Patrick Lencioni

3. Performance Metrics: Meaningful performance metrics that measure progress toward your strategic goals and objectives are critical for success. This includes daily functional and plant-level information as well as corporate activities linked to the strategic priorities.

However, defining the metrics is only the beginning. Effective plan deployment not only identifies what those metrics are but also develops specific tactics to easily track and analyze those metrics. This often includes visual management tools created and maintained by team members on a daily or weekly basis.

Strategic Plan Management

Companies achieve their strategic goals when they apply the Plan, Do, Check, Adjust (PDCA) model to manage the plan. Effective plan management requires diligent attention to the following aspects:

1. Consistent Tracking – Many good strategic plans fail because companies get overwhelmed with daily disruptions. Companies must incorporate tools that support a culture of accountability and maintain focus on the plan. Some of the tools we recommend are Management for Daily Improvement, Gemba Walks, A3 tracking sheets, and routine short stand-up meetings.

2. Leadership Development – Strong leaders aren’t born, they are made. They have learned how to separate daily tactical needs from important strategic decisions. The process takes time and intentional effort as managers evolve from subject matter technical experts to transformational leaders. GaMEP can provide Leadership Needs Analysis and Advanced Leadership Skills training to help fill gaps and strengthen the team.

3. Cadence and Momentum– Momentum is maintained and builds on itself when team members understand their roles and witness progress toward the goal. Successful plan management includes routine, short, and productive meetings to communicate progress. Leadership must be committed to and consistent with this process. This requires thoughtful analysis of available time and resources during the planning phase and a process to react immediately to any abnormal results.

Next Steps

Whether your company is large or small, strategic planning is a critical tool for future success and growth. GaMEP’s strategic planning process helps manufacturers establish and execute a relevant and effective strategic plan and is broken into 4 distinct phases: Discovery, Development, Deployment & Plan Management.

This tip sheet describes the process of the last two phases; Deployment & Plan Management. Read How to Write an Effective Strategic Plan, for more information on the Discovery and Development phases.

By: Adam Hayes, Senior Project Manager, Georgia Manufacturing Extension Partnership