CHPS of Insight Episode 10: Cybersecurity and the Defense Industry

In the ever-evolving landscape of cybersecurity, staying informed about compliance requirements is critical for organizations engaged with the Department of Defense.  

In this episode of “CHPS of Insight,” Ron Sullivan spoke with David Fraley, a cybersecurity expert and CMMC advisor who sheds light on the nuances of the Cyber Security Maturity Model Certification (CMMC). Their discussion delved into the expectations, challenges, and best practices for achieving compliance in this vital area. 

Understanding the CMMC Compliance Landscape 

The CMMC framework is crucial for government contractors, enforcing cybersecurity hygiene aligned with NIST standard 800-171, especially within the Department of Defense (DoD).  Fraley provided insight into the historical context of CMMC, explaining its origins from the 2015 DFARS Clause and the phased implementation process established by the DoD. Recently, a pause in third-party certification requirements has sparked uncertainty, but compliance with NIST standards remains non-negotiable. 

The Compliance Challenges 

Fraley highlighted the significant financial burden and administrative challenges, particularly for small businesses striving to meet CMMC requirements. He discussed the disparities between estimated compliance costs by the DoD and real-world assessments, illustrating a sizeable financial impact on the defense industrial base. 

Current Compliance Status 

The conversation emphasized concerns about the defense industrial base’s overall compliance, with many organizations falling short of meeting the stringent demands of NIST 800-171. Fraley shared his experience with organizations lacking essential components like system security plans and explained the importance of accurate SPRS filings to avoid legal liabilities. 

Recommendations for DIB Companies 

Fraley urged companies within the defense industrial base (DIB) to actively pursue compliance, citing that inaction poses a significant risk. He advised partnering with reliable CMMC advisers or managed service providers to support long-term compliance efforts and emphasized the importance of honesty in compliance reporting. 

Insights for DoD Officials 

Fraley forwarded recommendations for DoD officials, advocating for more flexible and scalable compliance models. He proposed enhancing the use of AI for SPRS submissions and creating incentives for third-party assessment completion to encourage widespread compliance. 

“Get Compliant. Doing Nothing is a Great Big Risk.” 

Both Sullivan and Fraley underscored the importance of compliance with NIST 800-171 as a necessity rather than an option. Fraley’s closing remark encapsulated the urgency of the matter: “Get compliant. Doing nothing is a great big risk.” 

In this complex arena, navigating compliance is not about finding shortcuts but about understanding regulations thoroughly and implementing robust cybersecurity practices. Organizations need to be proactive in addressing these challenges to safeguard national security and enhance their operational resilience. 

How Organizations Can Stay Ahead 

As the digital landscape continually evolves, staying informed and prepared in cybersecurity is paramount. Engaging with experts and adapting best practices can arm organizations against future uncertainties, ensuring they remain at the forefront of compliance and operational excellence. 

This podcast is intended for general informational purposes only and does not constitute legal or financial advice or a solicitation to provide legal services. The information in this podcast is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Listeners should not act upon this information without seeking professional legal counsel. The views and opinions expressed in the podcast represent those of the individual speaker only and are not necessarily the views of Clark Hill PLC.