Cybersecurity

About CMMC

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a comprehensive framework launched by the Department of Defense (DoD) to protect the Defense Industrial Base (DIB) from increasingly frequent and complex cyber-attacks. It particularly aims to safeguard information defined as Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) shared within the DIB.

CMMC 2.0 builds on existing trust-based regulations (DFARS 252.204-7012) by adding a verification component for cybersecurity requirements. The program has three key features:

  • Tiered Model: CMMC requires that companies entrusted with national security information implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. This regulation also sets forward the process for requiring protection of FCI and CUI information that is flowed down to subcontractors.
  • Assessment Requirement: CMMC assessments allow the DoD to verify the implementation of clear cybersecurity standards though use of approved auditors.
  • Implementation through Contracts: Once CMMC is fully implemented, certain DoD contractors that handle FCI and/or CUI information electronically will be required to achieve a particular CMMC level as a condition of contract award.

It is imperative that all HII subcontractors and/or suppliers that receive and generate FCI and/or CUI meet these new DFARS requirements to be eligible for future work that will contain CMMC 2.0 requirements. Together our continued diligence will protect vital information, minimize risks and secure a competitive advantage for all parties.

Cyber Incident Reporting

When a cyber-incident is discovered, contractors, subcontractors and suppliers must conduct a review for evidence of compromise of covered defense information and report to the DoD and HII within 72 hours. A “Cyber incident” is defined as actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

Supplier Flow Down

When engaging with other suppliers that require access to covered defense information in performance of a contract, include the DFARS 252.204-7012 clause in any subcontracts, or similar contractual instruments with those suppliers. Read the full clause here.

Logo For Menu
Search
Close this search box.