Manufacturers, contractors, and suppliers who are members of (and/or affiliated with) the U.S. Defense Industrial Base (DIB) must prepare now to ensure assessment readiness. Fears of a near-term enormous bureaucratic traffic jam are arising as tens of thousands of SMBs scramble to become CMMC compliant to avoid administrative exclusion from the DOD bidding process.

1. CMMC for Contractors and Manufacturers:
What to Know for 2023
December 13th, 2022

2. Today’s Speakers
Moderator
Edward Keck, Jr. – Partner and
Market Leader, Cyber and
Information Security Services
ekeck@withum.com
Presenter
Michael Seip – Lead Consultant,
Cyber and CMMC Advisory
mseip@withum.com

3. CMMC 2.0 At A Glance
This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
Figure source: OUSD A&S – Cybersecurity Maturity Model Certification (CMMC) (osd.mil)

4. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
Key near-term dates regarding compliance
1. CMMC Interim Rule expected ≈ March 2023
• Quick refresher: Will require compliance with 110 NIST 800-171 controls.
• Generally believed that the final form of this Rule will require a 3rd party
(external) audit for nearly all* contractors requiring use of
Controlled Unclassified Info (CUI). (i.e. ML-2)
• * = Rule enables POA&Ms [Plan of Actions & Milestones]
• POAM is a detailed - measurable - documented plan to achieve
compliance in any non-compliant audit areas.
• May be rejected if insufficiently detailed…

5. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
Key near-term dates regarding compliance
2. DFARS 7019 Final Rule approval – “December 2022” (!!!)
Upon approval – this requires contractors to fully comply with:
• All 110 NIST 800-171 controls
• Complete a SPRS score (NIST 800-171) + report
DOD is taking a hardline posture on this – have made very public reference
(several times) regarding Dept of Justice actions to enforce False Claims Act….
LITIGATION

6. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
So…
• Firms with significant revenue from DOD contracts –the time is nigh…
• Audits are underway for peer firms as we speak…
• If you haven’t already begun preparation, START IMMEDIATELY!
• Until now, a few contractors have been through a provisional ML-2 audit, mostly
those seeking immediate designation as C3PAO orgs.
BUT
• The number of external audits will increase, probably sharply.
There is an urgent need to adequately develop the CMMC
Assessor community & infrastructure.
• Why? Estimated 80,000+ DIB orgs will require an
external audit for ML-2 certification.
• This screams BACKLOG

7. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
So it begins….

8. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
What can clients do now to prepare?
 CMMC ML-1/2 Processes & Controls highly aligned with NIST 800-171
• This has been described as an “Organizational Behaviors & Training” -a
related phase of preparation.
• i.e. How do you execute day-to-day ops with CMMC-covered info? Any
gaps?
• Gather documented evidence to build a SSP (System Security Plan)
re: Processes and Security Policies IAW NIST 800-171. [Example next slide]
 There will also be an infrastructure component of preparation - needed to
achieve compliance.
• DEPENDS – what is the nature of the product or service?
• Prime or Subcontract-related?
• There is a wide range of DIB manufacturing processes – so this varies widely.
• Computing infrastructure: dedicated CMMC sandbox or shared enclave (cloud-based,
perhaps)

9. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
What can clients do now to prepare?
• Clients can immediately begin formal
documentation of security controls
required IAW NIST 800-171.
Example(s):
• Ensure use of NIST-compliant Data Sanitization
Certificate (or something closely equivalent)
This certificate is simply an example of the types of information that
should be collected and how a certificate might be formatted. An
organization could alternatively choose to electronically record
sanitization details, either through a native application or by using a
form such as this one with an automated data transfer utility (such
as a PDF form with a button to send the data to a database or email
address)
. In the event that the records need to be referenced in the future, electronic records will likely
provide the fastest search capabilities and best likelihood that the records are reliably retained.
• Source: Appendix G of NIST Special Publication (SP) 800-88 Revision 1, Guidelines for
Media Sanitization, available at https://doi.org/10.6028/NIST.SP.800-88r1

10. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
What can clients do now to prepare?
• There are several vendors/platforms offering CMMC compliance tracking SW.
• Example above is of CMMC compliance mgmt platform from Summit7
• Lots of supporting info online & is a well-regarded option… there are several others equally as
capable.
• https://info.summit7.us/blog/a-detailed-review-of-nist-sp-800-171
• Get Organized. Start with planning for the process to come.

11. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
What can clients do now to prepare?
• Example above is of CMMC compliance mgmt platform from ComplyUp
• Lots of supporting info online & is a well-regarded option… there are several others equally as
capable.

12. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
MD&L client notable items
• If MD&L client uses ICS (Industrial Control Systems – e.g. SCADA), there is
special attention/focus from both regulators and threat actors.
• Know if client is part of designated ‘Critical Infrastructure’.
• Could result from the mission focus of service offerings and
capabilities.
• Or through use of hardware/tech considered thus.
• APT groups and higher capability threat groups increasingly targeting ICS orgs.

13. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
MD&L client notable items
• APT groups and higher capability threat groups increasingly targeting ICS orgs.

14. What now?
Check OUSD(A&S) website – 5 “baby steps down the hall”
This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.

15. What now?
START. PREP. NOW!!!!
Doing business with US Gov’t will
require some form of cybersecurity
compliance and verification in the
future.
• It will almost certainly be
CMMC/NIST (or, at minimum, will
be derived from them).
• Withum CMMC Advisory & Prep
is here to help.
“The worst thing that can happen
is you make your company more
secure.”

16. This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2022 WithumSmith+Brown, PC All rights reserved.
For information, please contact:
Withum Cyber
Security Advisory Services & CMMC Advisory
Wcyber.CMMC@withum.com
Michael Seip, CMMC-RP
Office: (973) 358-2537
mseip@withum.com
Edward Keck, Jr., MBA, CISSP
Office: (973) 867-7447
ekeck@withum.com