Welcome back to our monthly recap of the Cyber AB town hall! April’s session was packed with updates and insights that are crucial for anyone navigating the complexities of CMMC compliance. Here are the key takeaways from the town hall:
Key Takeaways
- Leadership Transition: Mike Snyder steps in as acting director of CAICO.
- CAGE Code Hierarchy: Ensuring accurate CAGE code data is critical for successful data transfer to SPRS.
- GAO Audit: Focus on the capacity of the CMMC ecosystem with 67 C3PAOs currently in the marketplace.
- Rulemaking Progress: Title 48 publication expected soon, reinforcing DoD’s commitment to CMMC.
- New Framework Partnership: Collaboration with SCF Conformity Assessment Program (SCF CAP).
- MSPs and MSSPs Role: Clarification on what MSPs and MSSPs can and cannot do in CMMC compliance.
- Ecosystem Ethics: Importance of maintaining integrity and impartiality in the assessment process.
- In Memoriam: Tribute to a CMMC pioneer who recently passed away.
Let’s dive into the highlights.
Leadership Changes and Program Updates
The town hall kicked off with a significant leadership update. Kyle has stepped down, and Mike Snyder has stepped in as the acting director of CAICO. This transition is expected to be smooth, ensuring continuity in the program’s direction and goals.
In terms of program updates, 85 OSCs have attained final approval, marking a milestone in the CMMC journey. This achievement underscores the growing momentum and commitment within the ecosystem.
CAGE Codes and Data Transfer Challenges
One of the critical topics discussed was the issue of CAGE codes and their hierarchy. Ms. Dana Mason from the CMMC Program Management Office emphasized the importance of ensuring that all CAGE codes in your CMMC assessment are in the same hierarchy. This is crucial because inaccuracies in CAGE code data are causing issues with data transfer to SPRS.
To address this, eMASS will be enhanced to validate CAGE codes before syncing with SPRS. This long-term fix, expected to take over six months, aims to prevent errors that currently require C3PAOs to re-enter assessment data. In the meantime, OSCs must ensure an accurate hierarchy of CAGE codes in SAM and SPRS.
GAO Audit and Ecosystem Capacity
The General Accountability Office (GAO) audit focused on the capacity of the CMMC ecosystem overall. Currently, there are 67 C3PAOs in the marketplace, with two more on the way. This audit is a crucial step in assessing the readiness and scalability of the ecosystem to handle the growing demand for CMMC assessments.
Rulemaking and DoD Support
Michael Duffey provided an update on the rulemaking process, indicating no setbacks. Title 48 is expected to be published soon, reinforcing the DoD’s commitment to CMMC as a foundational requirement. Pentagon leaders continue to show strong support for the program, ensuring its forward momentum.
New Framework Partnership
A new partnership was announced with the SCF Conformity Assessment Program (SCF CAP). This collaboration aims to enhance the framework and provide more robust support for MSPs and MSSPs in their CMMC compliance efforts.
MSPs and CMMC Compliance
The town hall also highlighted the role of MSPs and MSSPs in CMMC compliance. Key points included:
- MSPs and MSSPs are always considered ESPs.
- ESPs cannot assume overall responsibility for your CMMC conformity.
- They cannot loan or bequeath their System Security Plan (SSP).
- They cannot satisfy all 110 security requirements and 320 assessment objectives for you.
- They cannot provide a pre-validated CRM or SRM.
- They cannot save you if you have not properly prepared for CMMC.
Ecosystem Ethics
Ethics within the ecosystem were also discussed. C3PAOs cannot advise on the front end to develop a program and then complete the assessment for the same entity. This separation ensures the integrity and impartiality of the assessment process.
In Memoriam
The town hall concluded with a tribute to a CMMC pioneer, Robert S. Metzger, Esq., who recently passed away. His contributions to the program were invaluable, and he will be greatly missed.
