Small Businesses Face Challenges Under New CMMC Regulations

Concerns are mounting for small businesses as the Department of Defense (DoD) prepares to implement revamped Cybersecurity Maturity Model Certification (CMMC) rules. While the changes aim to ease compliance burdens, many small contractors remain apprehensive about the costs and complexities involved in meeting the new standards.

Key Takeaways

• The CMMC program aims to enhance cybersecurity across the defense industrial base.

• Small businesses express concerns over compliance costs and the feasibility of meeting new requirements.

• The DoD has made adjustments to the CMMC framework to alleviate some burdens on smaller contractors.

Overview of CMMC

The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the DoD to bolster cybersecurity measures within the defense supply chain. The updated CMMC 2.0, set to take effect on December 16, 2024, introduces three levels of certification:

1. Level 1 (Foundational): Basic cyber hygiene practices with 17 required controls.

2. Level 2 (Advanced): Intermediate practices requiring compliance with 110 controls.

3. Level 3 (Expert): Advanced cybersecurity practices for the most sensitive information.

Compliance Challenges for Small Businesses

Despite the DoD's efforts to modify the CMMC to support small businesses, significant challenges remain:

• Cost of Compliance: The financial burden of achieving certification can be substantial. Estimates suggest:

• Resource Limitations: Many small businesses lack dedicated IT or cybersecurity personnel, making compliance more difficult.

• Technological Upgrades: Upgrading systems to meet CMMC requirements can be both costly and time-consuming.

• Training Needs: Providing adequate cybersecurity training for employees is often a struggle for small firms.

DoD's Adjustments to CMMC

In response to feedback from small business advocates, the DoD has made several adjustments to the CMMC framework:

• Not all companies will require third-party certification, allowing some to defer certain cybersecurity requirements.

• The introduction of special IT "enclaves" aims to reduce costs by allowing companies to handle sensitive information separately from their main networks.

However, the Office of Advocacy within the Small Business Administration (SBA) has called for clearer guidance on creating these enclaves and the role of third-party assessment organizations (C3PAOs).

The Road Ahead

As the deadline for compliance approaches, small businesses are encouraged to take proactive steps:

• Leverage Cybersecurity Tools: Utilize cost-effective cybersecurity solutions and consider hiring Managed Security Service Providers (MSSPs) for expertise.

• Seek Financial Assistance: Explore government grants and programs designed to support small businesses in achieving compliance.

• Implement a Phased Approach: Start with Level 1 compliance and gradually work towards higher levels as contracts require.

While the path to CMMC compliance may seem daunting, with strategic planning and support, small businesses can navigate these regulations successfully. The long-term benefits of enhanced cybersecurity and access to government contracts can outweigh the initial costs, making it a worthwhile investment for the future.

Sources

• CMMC is coming, but concerns for small businesses persist under revamped rule, Federal News Network.

• An introduction to CMMC for the small and medium-size contractor, NH Business Review.