Technology

CMMC Q&A: Cybersecurity Requirements for DoD Contractors

October 25, 2022 By

Cybersecurity Maturity Model Certification (CMMC) is a framework of various cybersecurity standards and best practices to safeguard sensitive national security information from increasingly frequent and complex attacks. CMMC 2.0 compliance is a requirement for all government contractors working with the Department of Defense (DoD).

In 2015, the DoD released the Defense Federal Acquisition Regulation Supplement (DFARS), a series of cybersecurity requirements contractors and subcontractors in the Defense Industrial Base (DIB) had to follow to protect Controlled Unclassified Information (CUI). As part of the certification process, it includes complying with the National Institute of Standard and Technology (NIST) Special Publication (SP) 800-171 Revision 2 (NIST SP 800-171 R2).

Contractors will lose existing DoD contracts and won’t be able to bid for new ones until they can demonstrate compliance with the required level in the contract. The Department of Justice (DOJ) has also launched the Civil Cyber-Fraud Initiative, which will utilize the False Claims Act to pursue cybersecurity-related fraud by government contractors and grant recipients who falsely claim compliance.

What are the CMMC Requirements?

In 2020, the Department of Defense (DoD) began to demand a self-assessment using a points-based system to prove compliance from defense contractors – an honor system, if you will. After completing the self-assessment, contractors are required to submit their scores to the DoD’s Supplier Performance Risk System (SPRS). A System Security Plan (SSP) is also required, containing comprehensive details of the organization’s networks, systems, processes, policies and security controls including how those controls are being implemented and improved over time. Contractors must currently have a SPRS score listed in the SPRS database in order to bid and receive DoD contracts.

In a significant move, the DoD introduced the Plan of Actions and Milestones (POAM) where organizations who have not yet fully implemented 800-171 can submit a solid plan for achieving full compliance, with specific dates and a timeline. This POAM is submitted with the SPRS and enables organizations to begin working for federal agencies whilst they simultaneously work towards full implementation of 800-171. Once CMMC is fully implemented, the timeline for completing a POAM is six-months from submission of a SPRS score and POAM.

Companies that handle CUI must also submit to and pass an independent audit proving that they meet the 110 controls outlined in NIST 800-171 R2. This audit is at the company’s expense.

When will CMMC Certification be required?

Mandatory SPRS score reporting has already begun in order to bid for contracts (to include creation of an SSP and POAM). Voluntary audits of those who claim to be CMMC compliant began in August 2022. It is expected that all the requirements of CMMC will be finalized by end of first quarter 2023.

Who needs CMMC Certification?

CMMC is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors. According to the DOD, the CMMC requirements will affect over 300,000 organizations.

How will CMMC 2.0 be enforced?

Today, companies without a SPRS score cannot bid for new contracts. Those that can show compliance to CMMC Level 2 or 3 must submit to an audit by a third party. Failing the audit could result in loss of contracts or the ability to bid for future contracts. Any company that falsifies their compliance could face a False Claims Act lawsuit from the Department of Justice. The DOJ has already begun pursuing and collecting millions in fine from cases of cybersecurity-related fraud by government contractors and grant recipients.

What will be the consequences of not completing CMMC Certification?

Non-compliant companies will lose the ability to bid for new DoD contracts.

What are the different CMMC Levels?

You may be asking yourself, “What CMMC level do I need?” Determining the CMMC level you need depends on the type of services and information that your company accesses and stores in your information systems.

CMMC requirements are based on the type of information a company handles. Companies that provide COTS (Commercial off-the-shelf) service to the DoD and only handles Federal Contract Information (FCI) must comply with CMMC Level 1. All companies that handle CUI (Controlled Unclassified Information) must comply with Level 2 or 3 and have implemented 110(+) controls as well as prove successful implementation through an audit by an independent agency. For more details:

Level 1 (Foundational) only applies to companies that focus on the protection of FCI. Level 1 is based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.
Level 2 (Advanced) is for companies working with CUI. CMMC 2.0 Level 2 requirements mirror NIST SP 800-171 and aligns with the document’s 14 levels and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI.
Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on DoD’s highest priority programs. The DoD has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

In addition, Levels 2 and 3 will required a third-party assessment. See the chart below for an overview.

Are the CMMC requirements for small businesses the same as those for larger businesses?

CMMC requirements are not based on the size of the business but the type of information to which the company has access in order to do business with the DoD. Companies that only handle FCI (Federal Contract Information) do not have as stringent requirements as those who handle CUI (Controlled Unclassified Information).

How do I complete a CMMC Audit?

CMMC requires all DoD contractors that meet the requirements for Level 2 or 3 to get audited and obtain certification from a trusted and approved third-party assessment organization (C3PAO). For Level 2 compliance the CMMC Accreditation Body (CMMC-AB) is responsible for reviewing audits and issuing certificates, however C3PAO must perform an audit. For a small subset of contractors who must comply with Level 3, the federal government will conduct the audit.

The CMMC audit cost depends on the size of an organization. Notably, Companies should expect to incur the following types of costs in a CMMC audit process:

Audit preparation costs: Also referred to as soft costs, audit preparation costs are the expenses for preparation and external consultancy.
Hard costs: Hard costs are also incurred in audit preparation and the audit process and may involve investments made in processes needed to meet audit. This also includes costs for implementing authentication mechanisms, endpoint security, and log monitoring.

What is the total cost to get CMMC Certified?

There is no set cost to CMMC compliance. In addition, CMMC is not a “one and done” milestone. It will require time, personnel and expense to both achieve initial compliance and the work necessary to maintain compliance. CMMC Certification costs will vary by company depending on:

what level of compliance needs to be achieved,
where a company is in their current journey to CMMC compliance,
the types of controls that need to be purchased, installed, configured and in place to achieve compliance,
the cost of managed service providers (MSPs) and other vendors to perform installation and configuration of said controls,
the cost of maintaining systems and controls and
the cost of additional employees to maintain, update and manage the Risk Management, Policy and Procedure, Monitoring and Audit aspects of NIST 800-171 required to keep the company in compliance.

A good rule is that it will take most companies six to 12 months of time, talent and information system upgrades to gain compliance.

How long does it take to become CMMC Certified?

General estimates are six to twelve months to achieve compliance and certification.

How does CMMC compare to NIST 800-171?

NIST SP 800-171 lays out the requirements for any non-federal agency that handles controlled unclassified information (CUI), or other sensitive federal information. It details how organizations should protect this information. First published in 2015, the goal is to strengthen the federal supply chain and ultimately protect national security as a whole.

The “800-171”, as it’s known, is made up of 110 controls divided into 14 control families, and takes around half a year to implement. It’s important to note that there is no certification to prove compliance with this framework. It was originally developed to provide guidance to the DFARS clause (the Defense Federal Acquisition Regulation Supplement)- the original cybersecurity requirements from the DoD.

Since DFARS is still a listed requirement in most government contracts, if you are bidding on a contract or have been awarded the work, you’ll need to be compliant with all 110 NIST 800-171 controls in order to fulfill the DFARS clause.

Unfortunately, due to the lack of certification, the DoD found that contractors were claiming to uphold all of the NIST 800-171 standards, but in reality, they were not. DoD decided that it was necessary to develop a certification process to ensure that contractors were compliant with a basic set of cybersecurity controls: thus the CMMC and NIST 800-171.

How can GaMEP help my company become CMMC Compliant?

GaMEP can perform a CMMC Gap Analysis and Readiness Assessment. The gap analysis and readiness assessment are foundational steps for companies to gain a detailed understanding of how close they are to meeting the requirements of their targeted CMMC level.

The Readiness Assessment will help uncover systems and processes that may not meet the standards outlined in NIST 800-171, such as:

How is data stored and access to information controlled?
Are incident response plans in place, current, and effective?
Are IT staff and other personnel adequately trained?
How are security protocols implemented and maintained?

The resulting Gap Analysis will pinpoint risk areas for contractors and facilitate the creation and execution of the Remediation Plan, either by the MSP or utilizing in-house resources. From the Gap Analysis, GaMEP can assist a company with creating the SPRS, SSP and POAM necessary to begin the CMMC process and bid for DoD contracts.

Without an exhaustive Gap Analysis in hand, DoD contractors may find it impossible to identify risks, prioritize activities, and determine costs for any remedial steps required for CMMC certification.

What if I am not located in Georgia?

Check with your local state MEP to see if they can provide CMMC services.

Where can I complete CMMC training or learn more about CMMC requirements?

You can learn more about CMMC by contacting your GaMEP regional manager or by filling out the Contact Us form.

By: Michael Barker, GaMEP Cybersecurity Project Manager

Reshoring Your Supply Chain: Starting Points for Small to Mid-Size Manufacturers

July 18, 2022 By

“Reshoring”, also known as onshoring, has never been a hotter buzzword, leaving many to ask what is reshoring and what could it mean for your business?

The definition of reshoring is “the practice of bringing manufacturing and services back to the U.S. from overseas”¹Reshoring as a supply chain initiative has been around for over a decade, but as ports are bottlenecked and transportation costs continue to climb, companies and customers are frustrated and beginning to see it as a more attractive option than ever before. Add in extended lead times and shortages in consumer products and you have what seems to be the foundation of a reshoring strategy.

Yet the thought of reshoring some or all of the supply chain for a small or mid-sized manufacturer who may already be struggling with limited resources can seem to be an overwhelming task. Conceptually, it makes sense. Reshoring can solve problems, mitigate risk, lower costs, provide a ‘greener’ solution, and even create jobs. Catching this vision, especially now, is easy, but putting a plan in place to achieve this goal may seem impossible.

One approach is to focus on a few key starting points to research and analyze the advantages and disadvantages of reshoring, while conserving your valuable resources and giving your team the information they need to make strategic decisions.

History

Go back to why the decision was made to move the supply chain offshore. Dust off the presentations and pull those old Excel files from the archives. Answer these questions:

What was it that drove this decision?
What has changed since the decision was made?
If you used current data with the same criteria, would the evaluation yield the same recommendation?
What have been the positive results of this move?
While recent challenges have magnified the disadvantages of offshoring, when was the offshore supply chain working well and why?
Are there reshoring disadvantages that should be evaluated?

There is a reason that reshoring wasn’t seriously considered until now, and you have to find that reason to make an informed decision.

Problem Statement and Solution

Once you understand why the supply chain went offshore in the first place, you must quantify the current problem, or problems, you are trying to solve. Reshoring cannot be a solution in search of a problem – that approach won’t be sustainable. This is where narrowing the focus to match your available resources becomes critical. Write a problem statement to help you discover:

Are there a handful of components that are driving the majority of your problems?
How will reshoring, specifically, address the problems and provide a more workable solution than the current supply chain?
Are there solutions other than reshoring that could also address these problems?

Focus on real, tangible issues and start small, otherwise your problem statement will become so large or general that it’s meaningless or unattainable.

Technology

Evaluate your current supply chain technology and determine how it can be leveraged to support reshoring.

The supply-chain industry has understood that it can no longer treat technology as an isolated service, i.e., as a means to an end. Technology will inevitably become the backbone of the supply-chain industry. ²

While this backbone will be critical to successful reshoring, the key to success is to keep it simple. Utilize what you have, while in parallel beginning to build a longer-term vision and supporting strategy.

Many small to mid-sized manufacturers have much of their supply-chain data in Excel files downloaded from an ERP system of some type. If that’s the case, build a visual of these siloed Excel databases and determine your starting point, then ask these questions:

Will the technology and data you are using to support offshore suppliers have to change in some way to provide the supply chain visibility you need for reshoring?
Can you leverage the suppliers’ technology and/or integrate it with yours easily?
What benefits would there be to implementing new technology?
Does your team have the bandwidth to take on a new technology implementation right now?

Analytics

Make sure you are measuring apples to apples as you evaluate costs. If your analytics have not evolved over time to keep up with global supply chain evolution, this needs to be addressed before any final recommendations regarding the solution to your current supply chain problems can be made. In this regard, evaluating these questions can help get you started:

How are you measuring your supply chain?
Are you considering all parts of the landed cost equation?
Are you factoring in cost predictability, possible import tariffs, carbon offset costs, or what you may have to spend to react to a late or cancelled delivery?

Take a big picture approach to evaluating costs for both onshoring and offshoring. While you can’t necessarily predict future unknown costs or disruptions, you can account for possible or likely risks and weigh them as part of the overall equation.

Management and Team

Assess your overall supply chain management and team bandwidth, strengths, and weaknesses. This is in many respects no different than any other organization-wide project that you may pursue: it’s the team on the ground that will have to make it happen and change management will likely be a significant part of the overall project.

As noted in Supply Chain Management Review: Supply chain and business leaders must model High Performing Organization (HPO) culture, not only embracing new behaviors like adaptability, emotional intelligence and diplomacy, but also abandoning leadership behaviors that reduce employee engagement, inclusion and empowerment. Leadership must anticipate the resources employees need and make them feel safe to openly discuss mistakes and lessons learned to encourage smart risk-taking and agility.³

Consequently, you will need to ask questions like:

What is your supply chain management organizational structure and how would it need to change with reshoring?
Does your team have the resources they need to establish new suppliers and ensure these suppliers’ success?
Is your current team environment one in which the challenges of major supply chain changes can be openly discussed, measured, and acted upon?

As you determine the role your team will play in your new supply chain ecosystem, be sure to consider potential partnerships with suppliers. Partnerships can effectively expand your own team in addition to providing a real-time link to your most critical suppliers.

Completing your reshoring plan will require far more work than the starting points listed above but the initiative may have substantial benefits that help your company achieve long-term success. If you are struggling with how to make the leap from vision to project, these key points can help kick-off the process and give you the information you need to start a reshoring project.

With project managers located within two hours of any manufacturing plant in Georgia, the Georgia Manufacturing Extension Partnership at Georgia Tech, can help you locate the suppliers you need to reshore, assess the ability of your organization to support a reshoring strategy, and advise you on your analytics and technology. Contact us for more information on supply chain services or help with other aspects of your business.

¹www.reshorenow.org

² “Supply Chain Trends to Watch – 2021”, www.sourcingandsupplychain.com

³ “Developing High Performance Leadership”, Supply Chain Management Review, www.scmr.com

By: Dean Hettenbach, Project Manager, Georgia Manufacturing Extension Partnership

Driving Advanced Manufacturing in Georgia

June 7, 2022 By

Advanced manufacturing in Georgia is a huge deal – the sector is responsible for 10 percent of state gross domestic product (totaling nearly $62 billion in 2019), 92 percent of exports, and employs more than 380,000 people. The sector’s importance is no accident. It’s the result of — according to the Georgia Department of Economic Development’s Center of Innovation for Manufacturing — the pro-business climate in the state; a well-trained workforce; and a location and logistics network that allows companies to reach 80 percent of the United States in hours by truck, train or plane. The Port of Savannah, with its link to the rest of the world, doesn’t hurt either.

Georgia Tech contributes to this all-important economic driver in a number of ways, including through the Georgia Manufacturing Extension Partnership (GaMEP) and other programs of the Enterprise Innovation Institute, that support manufacturers through coaching, training, and on-site project implementation. These programs help to connect companies to other Georgia Tech resources including, the Advanced Manufacturing Pilot Facility (AMPF), an R&D facility that provides space for industrial, academic, and government agencies, while also serving as a teaching lab for graduate students. Funded by a $3 million gift from the Delta Air Lines Foundation, AMPF is part of the Georgia Tech Manufacturing Institute.

Learn more about how Georgia Tech contributes to the manufacturing ecosystem in the state in the recent article, “High-tech Makers,” in Georgia Trend magazine.

Contact us for information on how GaMEP can connect you with resources at Georgia Tech and partner organizations. Thinking about implementing a new technology in your facility? Visit our Technology page, to see how GaMEP can help.

Cybersecurity Horror Stories from the GaMEP

October 19, 2021 By

Since its inception in October of 2004, Cybersecurity Awareness Month serves as a reminder of the importance of cybersecurity, providing individuals and organizations with the information and tools they need to be safer and more secure online. However, even as the cybersecurity industry continues to grow at a rapid rate each year, many organizations – especially small and medium-sized manufacturers – remain vulnerable and should start implementing processes now to protect themselves from the risk of cyberattacks.

According to Cybint, 95% of cybersecurity breaches are caused by human error. If a cybercriminal or hacker infiltrates your company, it’s generally through your weakest link and rarely in the IT department. This staggering statistic could be reduced if employee training at all levels was a critical component of every organization’s cybersecurity plan. With adequate training, employees can better understand what kind of vulnerabilities and threats their business operations are more likely to fall victim to.

Unfortunately, implementing a robust cybersecurity plan can sometimes prove to be intimidating and many organizations may not know where to start or how to engage their employees in the process. To keep things simple in the beginning, encourage your employees to abandon their practice of bad cyber hygiene habits. Not sure what some of these habits may look like? Read below for a list of the top 10 scariest cybersecurity mistakes our team has come across in the field:

1. Office staff with several computers all sharing the same login information on a post-it note in clear view.

2. Opening attachments on emails from unknown senders.

3. Allowing staff to transfer secure files to a USB stick to allow them to work on a home computer and then retransfer the file back to the office network computer the next day.

4. Not backing up critical manufacturing data and files to password-protected cloud storage or a secured server.

5. Failing to realize that the third-party service provider responsible for backing up critical manufacturing data did not complete the backup, or was not completing the backup daily as agreed upon.

6. Having your data unavailable due to a cyberattack and having to pay ransomware because you cannot resurrect your system data.

7. Not running recommended Windows or Mac system updates for known security issues regularly.

8. Assuming that cybersecurity is your MSP’s (managed service provider) problem since you pay them to keep your network safe.

9. Failing to keep your staff educated on and aware of phishing scams – which account for more than 80% of reported security incidents (CSO Online).

10. Believing that your organization is too small to be affected by a cyberattack because you only have a few computers connected to the internet.

Help reduce your organization’s vulnerability and cybersecurity risks by not committing any of these cyber-cardinal sins. For more information on how you can combat cyber threats and implement an effective cybersecurity plan, check out the following resources:

View our flyer on GaMEP’s General Cybersecurity Assistance Service

Visit the GaMEP Technology Services webpage

View the NIST MEP Manufacturers’ Guide to Cybersecurity.

By: Megan Johnson, Georgia Manufacturing Extension Partnership

Tips for Implementing Technology Solutions to Help Offset Productivity Issues

April 8, 2021 By

Change is hard. If this pandemic year has taught us anything, it’s how to adapt and adjust our way of thinking and doing business. The same goes for technology. It is always changing. Whether it is the latest upgrade for your smart device or the newest gadget to simplify your life, technology touches every facet of our personal and professional lives. The choices out there can be daunting and sometimes overwhelming, especially if you are a small to medium manufacturer. Do I really need technology to grow my business and thrive? Is technology safe for my company? What about my personnel, how will they be affected? The answer is not the same for everyone, but using these tips below can help guide you to the right solution for yourself and your company:

One size does not fit all: The fourth industrial revolution (Industry 4.0) is the use of technologies to form an interconnected and autonomous manufacturing environment. You do not have to implement all of these technologies at once. First, identify the pain points in your business such as operational inefficiencies, quality issues, or asset reliability. Then, let that business case help you decide the technology to pursue first and the depth of that technology that is needed to solve the issue on hand.
Start small: A complete overhaul is not necessary and unfeasible in most cases. You do not have to start over and connect your entire production line to the cloud all at once. There are affordable, easy to implement options available. Examples include adding a sensor or two to a machine center to track performance data in real time to better understand missed opportunities, or integrating one standalone machine to the network to facilitate smart decision making. These types of solutions allow you to ease your business into Industry 4.0 and simultaneously use technology to positively impact your business. Adding up a few of these technology implementation wins over time will help build confidence in your team and lead to a long-term Industry 4.0 strategy that becomes an integral part of your core business.
Don’t be afraid: Implementing technology does not necessarily lead to a reduction in employment. In fact, in many cases it will lead to workforce development. Even though machines are accurate and repeatable, people are still needed to manage the process, analyze the data output, and act on what to do with that data. Also, by adding a technology solution (like a sensor), you can capture that employee’s tribal knowledge and machine data, then create a recipe to automate the process of how to run that machine in the future. This helps create a culture that emphasizes learning, which leads to an increase in team members feeling more comfortable working with technology.
Data, data, data: If you have a choice, do you want to know when a machine will fail? Most will answer “yes” to this question but are still doing maintenance the old-fashioned way and guessing when it will fail (preventative maintenance). But by using the right technology you can tell exactly when a machine is going to stop working and do the corrective action just before it happens (predictive maintenance). Over time, using a conditioning monitoring device will give you the data to know when a failure will occur, and time to prepare for maintenance issues to avoid a catastrophic problem. This will lead to less unscheduled downtime and increased productivity, which impacts your bottom line and revenue. This is just one example of how a technology solution can help capture data and use it to solve real problems in your business.
Safety and security: As your organization progresses through implementing technology solutions and leveraging the power of data, there is an inherent risk of cyberthreat that must be carefully managed and mitigated. It is not a matter of if, it is matter of when your data could be compromised. The same principle of starting small and following basic data hygiene such as controlling when and who has access to your data and managing how data moves in your organization would go a long way. If you are planning on doing any work for the Department of Defense, the need to establish and demonstrate your organization’s maturity level on the cybersecurity front is key to your success. Working with professionals who can assess and guide you through each step in Cybersecurity Maturity Model Certification (CMMC) is paramount as this certification will be a requirement for all vendors in the very near future to be able to be awarded contracts from the Department of Defense.

By keeping these tips in mind, your path to implementing Industry 4.0 solutions can be less intimidating, more manageable, and allow you to leverage technological innovation to grow your competitiveness and gain new business.

If you are a small to medium manufacturer who needs help identifying or implementing technology solutions, contact your GaMEP Region Manager and they can connect you to one of our experts on questions related to Artificial Intelligence (AI), Industry 4.0, automation, and other technology needs that will lead to productivity gains for your company.

By: Raine Hyde, Marketing Strategist, Georgia Manufacturing Extension Partnership