[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]
CMMC IMPLEMENTATION: WHAT IT MEANS FOR
SMALL BUSINESSES
=======================================================================
HEARING
BEFORE THE
SUBCOMMITTEE ON OVERSIGHT, INVESTIGATIONS, AND REGULATIONS
OF THE
COMMITTEE ON SMALL BUSINESS
UNITED STATES
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
HEARING HELD
JUNE 24, 2021
__________
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Small Business Committee Document Number 117-021
Available via the GPO Website: www.govinfo.gov
__________
U.S. GOVERNMENT PUBLISHING OFFICE
44-926 WASHINGTON : 2021
-----------------------------------------------------------------------------------
HOUSE COMMITTEE ON SMALL BUSINESS
NYDIA VELAZQUEZ, New York, Chairwoman
JARED GOLDEN, Maine
JASON CROW, Colorado
SHARICE DAVIDS, Kansas
KWEISI MFUME, Maryland
DEAN PHILLIPS, Minnesota
MARIE NEWMAN, Illinois
CAROLYN BOURDEAUX, Georgia
TROY CARTER, Louisiana
JUDY CHU, California
DWIGHT EVANS, Pennsylvania
ANTONIO DELGADO, New York
CHRISSY HOULAHAN, Pennsylvania
ANDY KIM, New Jersey
ANGIE CRAIG, Minnesota
BLAINE LUETKEMEYER, Missouri, Ranking Member
ROGER WILLIAMS, Texas
JIM HAGEDORN, Minnesota
PETE STAUBER, Minnesota
DAN MEUSER, Pennsylvania
CLAUDIA TENNEY, New York
ANDREW GARBARINO, New York
YOUNG KIM, California
BETH VAN DUYNE, Texas
BYRON DONALDS, Florida
MARIA SALAZAR, Florida
SCOTT FITZGERALD, Wisconsin
Melissa Jung, Majority Staff Director
Ellen Harrington, Majority Deputy Staff Director
David Planning, Staff Director
C O N T E N T S
OPENING STATEMENTS
Page
Hon. Dean Phillips............................................... 1
Hon. Beth Van Duyne.............................................. 3
WITNESSES
Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC, Washington,
DC............................................................. 5
Mr. Scott Singer, President, CyberNINES, Madison, WI............. 7
Ms. Tina Wilson, Chief Executive Officer, T47 International,
Inc., Upper Marlboro, MD....................................... 8
Mr. Michael Dunbar, President, Ryzhka International LLC, Pompano
Beach, FL, testifying on behalf of the HUBZone Contractors
National Council............................................... 10
APPENDIX
Prepared Statements:
Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC,
Washington, DC............................................. 25
Mr. Scott Singer, President, CyberNINES, Madison, WI......... 33
Ms. Tina Wilson, Chief Executive Officer, T47 International,
Inc., Upper Marlboro, MD................................... 42
Mr. Michael Dunbar, President, Ryzhka International LLC,
Pompano Beach, FL, testifying on behalf of the HUBZone
Contractors National Council............................... 44
Questions for the Record:
None.
Answers for the Record:
None.
Additional Material for the Record:
Ho-Chunk Inc................................................. 51
IPC Report June 2021......................................... 59
National Defense Industry Association (NDIA)................. 74
CMMC IMPLEMENTATION: WHAT IT MEANS FOR SMALL BUSINESSES
----------
THURSDAY, JUNE 24, 2021
House of Representatives,
Committee on Small Business,
Subcommittee on Oversight,
Investigations, and Regulations,
Washington, DC.
The Subcommittee met, pursuant to call, at 10:01 a.m., in
Room 2360, Rayburn House Office Building, Hon. Dean Phillips
[chairman of the Subcommittee] presiding.
Present: Representatives Phillips, Davids, Evans, Craig,
Hagedorn, Meuser, Van Duyne, and Fitzgerald.
Chairman PHILLIPS. All right. Good morning, everybody. I
call this meeting to order.
And without objection, the Chair is authorized to declare a
recess at any time.
Let me start by saying that the standing House and
Committee rules and practice will continue to apply during
hybrid proceedings. All members are reminded that they are
expected to adhere to these standing rules, including decorum.
House regulations require members to be visible through a video
connection throughout the proceeding, so please keep your
cameras on. And also, please remember to remain muted until you
are recognized to minimize background noise. And turn your
microphone on when you are recognized, of course.
If you have to participate in another proceeding, please
exit this one and log in later. In the event a member
encounters technical issues that prevent them from being
recognized for their questioning, I will move to the next
available member of the same party and I will recognize that
member at the next appropriate time slot, provided that they
have returned to the proceeding.
For those members and staff physically present in the
Committee room today, we will continue to follow the most
recent OAP guidance. Masks are no longer required in our
meeting spaces for members and staff who have been fully
vaccinated. All members and staff who have not been fully
vaccinated are still required to wear masks and socially
distance. I do hope that we do all our parts to protect each
other and our staff.
With that, I will begin with my opening statement. Cyber
attacks have the potential to threaten public safety and
undermine the American economy and national security. The early
months of 2021 have provided harsh reminders of this very fact.
Over the past 6 months, hackers and other malicious actors have
held an oil pipeline for ransom, breached the Nation's largest
transit network, and attacked private companies to obtain
sensitive customer data.
According to the Council of Economic Advisers, malicious
cyber activity has cost the U.S. economy between 57- and $109
billion since 2016. With our society's reliance on technology
and digitization growing, there is no doubt that cyber attacks
will only become more prevalent moving forward.
Recognizing the urgency of cyber threats, the Department of
Defense has taken steps to protect sensitive defense
information from attacks aimed at over 300,000 companies that
compose the Defense Industrial Base, the DIB. One of these
efforts has been the creation of the Cybersecurity Maturity
Model Certification. The CMMC is a framework that seeks to
improve the protection of different types of sensitive,
unclassified information through the implementation of a
unifying security standard across the DIB.
The CMMC framework consists of a tiered system with a
series of processes and practices at each level. The program
was designed based on numerous cybersecurity standards and
frameworks. CMMC relies on third-party certification to assess
the relative cybersecurity maturity of DIB companies, thus when
the initiative is finally implemented and all contracts and
requirements incorporated a specific CMMC level, only those
contractors who have achieved the required CMMC level through
the certification process will be eligible for an award.
The need for cybersecurity is unquestionable. It is vital
that companies in the DIB become more resilient and prepared
for cyber attacks. With that said, the CMMC Initiative has the
potential of driving many small businesses out of the Defense
Industrial Base, therefore, we must get this right. To that
end, it is important to pay attention to the numerous red flags
that small businesses have raised about this initiative.
For example, many have a concern about the significant cost
associated with CMMC compliance. Guarding against cyber attacks
can be cost prohibitive for many small businesses. And firms
that seek to abide by CMMC must purchase new hardware and
software, replace outdated technical systems, and pay the costs
of initial certification and maintenance amongst other
expenditures.
Small businesses often run on thin margins as we know, and
the cost of CMMC has the potential to leave many small firms in
the sector without a chance to compete for government
contracts. Many small businesses also don't have the capacity
to deal with the complexity of the initiative. Employers at
small enterprises often wear many hats and have limited
regulatory or compliance resources. This means that independent
firms will be forced to turn to outside specialists for help to
navigate the program. For many small contractors, this will not
be feasible.
According to Department plans, the DOD will implement the
CMMC initiative on select contracts between fiscal year 2021
and 2025. In addition, in March, DOD initiated an internal
assessment of CMMC partially guided by an effort to manage
cybersecurity costs for small businesses. This is a very timely
hearing, as it allows us to take a closer look at the program
and its implications for small businesses. There is no doubt
that contractors working with the DOD must have adequate
systems in place to handle cyber threats. At the same time, we
cannot allow the program requirements to drive small businesses
out of the defense procurement space.
With that, I would like to yield to the Ranking Member, Ms.
Van Duyne, for her opening statement.
Ms. VAN DUYNE. Thank you, Mr. Chairman. We should have
compared notes before we gave our opening statements, because I
am going to echo many of the sentiments that you just shared.
Just a few short weeks ago, we saw how a malicious
ransomware attack perpetuated by foreign actors on the Colonial
Pipeline can cause chaos across the entire Eastern Seaboard.
And not long after that, another attack shut down one of the
leading meat producers in the United States. The potential for
profit and opportunity to disrupt U.S. critical infrastructure
has invited a number of cyber criminals to target U.S. network
vulnerabilities and one of the softest targets to obtain
valuable Department of Defense information is through our small
contractors.
Recognizing the increased vulnerabilities of small
contractors, the DOD initiated new cybersecurity assessment
framework, called the Cybersecurity Maturity Model
Certification, to assess contractor implementation of
cybersecurity requirements. While no one disputes the Federal
Government's need to address the growing cybersecurity risks
facing our Nation, I am deeply concerned that the CMMC has
created yet another hurdle to keep small businesses from
competing in the defense marketplace, exactly what we just
heard from our Chairman.
A major concern is the cost of compliance. No matter how
you look at it, adding stringent cybersecurity requirements
will be a costly endeavor for small businesses that are already
recovering from a pandemic. With limited resources compared to
the competitors in the defense contracting space, small
businesses are understandably wary of deploying that capital
without assurance that their investment will return in future
work.
The Federal Government has already experienced a 38 percent
decline in its industrial base for the past decade and measures
like this will only exasperate this exodus. Simply put, we need
to ensure a competitive contracting environment for small
business. This would not only benefit our small employers, but
would be a net benefit for our national defense.
I also have major concerns with the rollout of the CMMC for
a number of reasons. First, the assessments may be inconsistent
and unfair because the new process is being handled by many
newly trained assessors. There are also many questions
outstanding about how subcontractors will be treated under this
new framework.
And, finally, I am worried that small contractors will be
shut out of the conversation entirely, and forced to the end of
the line.
The fact is that this new process may threaten the
livelihood of many small businesses. No assistance, no
assessment means no certification, and no certification means
no work. Small businesses rightly fear that they won't be given
a fair share, left to fend for themselves, as we have too often
seen when it comes to sweeping government reforms.
Dealing with cyber threats is an extremely nuanced issue
that will require continued collaboration, and while the DOD
may have good intentions with the CMMC initiative, we must
ensure that the voices of small businesses operating in the
Defense Industrial Base are heard and have their concerns
addressed. I look forward to hearing the testimony of the
witnesses today.
And I yield back.
Chairman PHILLIPS. Thank you, Ms. Van Duyne. The gentlelady
yields back.
And I will just take a moment to explain how the hearing
will proceed.
Each witness will have 5 minutes to provide a statement and
each Committee member will have 5 minutes for questions. Please
ensure that your microphone is on when you begin speaking and
that you return to mute when you are finished.
With that, I would like to introduce our witnesses.
Our first witness is Mr. Jonathan T. Williams, partner with
the law firm of PilieroMazza in Washington, D.C. As Chair of
their government contracts group, he counsels companies on a
variety of Federal acquisition regulation compliance issues.
Mr. Williams is also a member of PilieroMazza's cybersecurity
and data privacy team. In this role, Jon works with Federal
contractors, particularly those who contract with the DOD, on
managing cybersecurity and establishing compliant and effective
safeguards. We appreciate your expertise on today's topic.
Our second witness is Mr. Scott Singer, president of
CyberNINES with offices in both Wisconsin and Minnesota. Mr.
Singer is a retired U.S. Navy captain bringing over 30 years of
military experience in both Active Duty and Reserve roles,
along with 26 years of industry experience. His company,
CyberNINES, is a service-disabled veteran-owned small business,
focused on cybersecurity services and a candidate third-party
assessment organization for CMMC. We appreciate you as well,
Mr. Singer, for your contributions to today's discussion.
Our third witness is Ms. Tina Wilson, founder and Chief
Executive Officer of T47 International, located in Upper
Marlboro, Maryland. Ms. Wilson is an Air Force veteran, and T47
International is an 8(a) veteran-owned, and women-owned small
business, offering a wide range of professional support
services to the defense community. We thank you also for
sharing your story today.
With that, our Ranking Member, Ms. Van Duyne, will
introduce Mr. Dunbar.
Ms. VAN DUYNE. Okay. Hold on just a minute. Thank you very
much.
I would like to welcome our final witness, Mr. Michael
Dunbar. Mr. Dunbar is the president of Ryzhka International, a
service-disabled, veteran-owned small business founded in May
of 2011, and a HUBZone certified firm as of February of 2014.
They have lubricants and fuel oil to government, commercial,
and maritime clients worldwide, and proudly provide 100 percent
American-made products. From its initial founding to today, the
company has grown from one to six employees and successfully
serves clients ranging from the U.S. Army Corps of Engineers,
the Department of Veterans Affairs, the U.S. Navy and Coast
Guard, the National Oceanic and Atmospheric Administration,
various shipyards in many of the dredging community.
Ryzhka International has been the proud recipient of
several awards. This is the Department of Defense's award for
support of the Guard and Reserve. And in addition to its
businesses, the company's secondary mission is to provide
gainful employment opportunities to qualified individuals from
disadvantaged segments of society, such as minorities, women,
people with disabilities, and veterans.
Chairman PHILLIPS. And we will begin with Mr. Williams--oh,
I am sorry.
Ms. VAN DUYNE. Sorry. You are good. You are good. The
secondary focus is no surprise considering Mr. Dunbar's own
military service in the U.S. Navy Nuclear Power program and its
status as a service-disabled veteran. After his military
service, Mr. Dunbar went on to spend the summer working on the
solid rocket boosters for National Aeronautics and Space
Administration's space shuttle.
Following that summer, he attended the University of Utah,
went on to have a successful career as an executive in the
biotech industry, and afterwards, started his own company. Mr.
Dunbar will be speaking today on behalf of the HUBZone
Contractors National Council, which is a nonprofit trade
association advocating for policies bringing opportunities to
HUBZone certified small businesses and the economically
disadvantaged communities in which these companies are based.
Mr. Dunbar, thank you for your participation today. We look
forward to hearing your testimony.
I yield back.
Chairman PHILLIPS. Thank you, Ms. Van Duyne. The gentlelady
yields back.
Sorry, Mr. Dunbar. My bio is about one sentence long, so I
am not accustomed to two pages.
With that, we are going to recognize Mr. Williams for 5
minutes for your opening statement. Mr. Williams.
STATEMENTS OF JONATHAN T. WILLIAMS, PARTNER, PILIEROMAZZA PLLC;
SCOTT SINGER, PRESIDENT, CYBERNINES; TINA WILSON, CHIEF
EXECUTIVE OFFICER, T47 INTERNATIONAL, INC.; AND MICHAEL DUNBAR,
PRESIDENT, RYZHKA INTERNATIONAL LLC, TESTIFYING ON BEHALF OF
THE HUBZONE CONTRACTORS NATIONAL COUNCIL
STATEMENT OF JONATHAN T. WILLIAMS
Mr. WILLIAMS. Good morning, Chairman Phillips, and other
distinguished members of the Subcommittee. My name is Jonathan
Williams, and I am a partner with the law firm PilieroMazza,
which represents government contractors. Many of our clients
are small businesses that work with the Department of Defense
as prime contractors and subcontractors. It is an honor to
participate in this hearing on DOD Cybersecurity Maturity Model
Certification to share my perspective on the CMMC Initiative.
DOD's focus on cybersecurity has been steadily building for
many years, with measures ranging from implementation of new
regulations and contract clauses to the elevation of
cybersecurity as the fourth pillar of DOD's acquisition
planning. DOD has left no doubt about the importance it has
placed on enhancing cybersecurity for the Defense Industrial
Base, and with good reason, as recent events like the pipeline
shutdown demonstrate.
CMMC marks a significant change in DOD's evolving approach
to cybersecurity. With CMMC, contractors will no longer be
allowed to use the honor system by self-certifying their
cybersecurity. Instead, contractors will have to apply for
certification from a third-party assessor. These so-called
C3PAOs will evaluate the contractor's cybersecurity against
established benchmarks and decide whether to certify the
contractor in one of five levels.
The lowest level of CMMC is level one, which requires the
fewest and most basic cybersecurity measures. The level one
requirements are things all businesses should be doing, like
spam filters and antivirus software. The cost and complexity of
the requirements increases significantly at the higher levels
of CMMC.
DOD has said it intends to start requiring CMMC on a few
contracts this fiscal year with that number increasing steadily
over the next several years until fiscal year 2026, when all
DOD contractors will be required to have CMMC.
However, the implementation schedule has slipped a few
times already and remains in flux. Approximately 2 years into
the CMMC Initiative, many practical questions that small
businesses are asking remains unanswered. These are basic
questions like, when will I need CMMC? How much will it cost?
What level do I need? And how do I get it?
Many small businesses will not be able to adequately
prepare for CMMC until these questions are answered. For
example, DOD estimates that most small businesses will only
need level one; however, that is not guaranteed. DOD agencies
are more likely to require at least level three for many of
their contracts, and prime contractors may flow down the same
level to their subcontractors.
Given the substantial difference in cost and technological
know-how between level one and level three, many small
businesses will be unable to compete if more than a level one
is required. From my discussions with the small businesses we
represent, I have several suggestions for how to make the CMMC
Initiative more manageable for small businesses, including the
SBA and DOD mentor-protege programs should be utilized to
ensure that mentors provide small businesses with resources and
guidance to obtain CMMC.
Joint ventures, a popular tool for small businesses to
pursue government work, should not be required to have CMMC
when the member companies are certified. C3PAOs should be
required to fast-track CMMC applications when the applicant is
a small business that is in line for award of a contract.
DOD contract clauses should prohibit prime contractors from
imposing a more stringent level of CMMC on a subcontractor than
is necessary based on the scope of the subcontract.
And finally, DOD and prime contractors should explore
alternative ways to give small businesses access to sensitive
information that will enable more small businesses to
participate on DOD contracts with a level one certification.
In closing, I believe the CMMC Initiative appropriately
aims to improve our Nation's cybersecurity posture. I do not
think small businesses would debate the importance of
cybersecurity, or that doing business with the Federal
Government is a privilege that requires investments in
compliance and infrastructure.
At the same time, the worthy goals of the CMMC Initiative
must be calibrated to avoid creating an unnecessarily high
barrier to entry for small businesses, which are the engine of
our economy and critical partners with the Federal Government
for innovation and provision of many necessary services and
supplies.
This concludes my testimony. Thank you, again, for the
opportunity to appear before you today.
Chairman PHILLIPS. Thank you, Mr. Williams. A perfect 5
minutes at that. We appreciate it.
Now we recognize Mr. Singer for 5 minutes.
STATEMENT OF SCOTT SINGER
Mr. SINGER. Thank you, Representative Phillips, Ranking
Member Representative Van Duyne, and members of the
Subcommittee, for inviting me to testify this morning. I look
forward to providing information that will help ensure we have
a secure Defense Industrial Base and find cost-effective
solutions to allow small business to fully comply with CMMC.
My name is Scott Singer, and I am the owner and president
of CyberNINES. CyberNINES was founded only in June of 2020;
however, thanks to the interim final rule released on November
30, 2020, we have been really busy. And I have done assessments
in the districts of some of the members of this Subcommittee.
Small businesses do not have purchasing or IT departments. They
do not have compliance or regulatory departments. We need to
make this easier for them. Primes, certified third-party
assessors, registered provider organizations, all can assist
these small businesses get compliant and reduce the complexity
for them.
Having a program where the primes take a strong guiding
hand of their supply chain is critical to maintaining these
small businesses as DOD suppliers. Of the last 33 basic
assessments CyberNINES has conducted, the average compliance
score was minus 105. Plus 110 is perfect. We have found that on
average, they are about only 34 percent of the way toward
meeting all the risk controls. Cost models put forth by the
government assume that companies are much further along on this
journey, and they actually should be by this point.
Assuming full compliance to NIST, the DOD has put out that
this will cost $26,000 to complete the 20 additional practices
followed by an additional $29,000 to be assessed by a C3PAO. As
discussed above, small businesses that we have assessed are
only partway there, and we have come up with costs more to the
tune of about $130,000 for these businesses to be able to be
compliant.
Last week, I conducted a basic assessment of a small
manufacturer in Minnesota. They had only six employees, one
small manufacturing space with three machines, and they do
excellent innovative work. I spent a good majority of my time
doing the assessment actually from the owner's house. This
year, he expects to make 875K in revenue. My estimate is that
if he wants to stay a DOD contractor, he will have to spend 10
percent of his revenue over the next 3 years alone on getting
compliant.
Small businesses have been directed to add their allowable
costs to get compliant to their indirect rates. Most don't do
cost reimbursement contracting for DOD. Moreover, market
factors around competition for orders will require them to
compete and lower prices. Established contractors will be more
likely to be able to provide a lower bid and win the order from
the prime. There should be a process separate from the
competitive marketplace to allow small businesses to get paid
for the reasonable, necessary, and allowable cyber compliance
expenses.
Companies further ahead should not be penalized and be able
to recoup their past expenses, too. In addition to the
difficulty small businesses have funding this effort, there are
bottlenecks for getting enough assessors. In doing the math, I
just don't see how--and this is my opinion--we can get enough
C3PAOs and assessors through the process to assess 300,000 DIB
companies by October 1, 2025. I saw one estimate that we would
need over 8,000 assessment team members working full-time from
today on to make this happen.
To get more C3PAOs through the process, I recommend there
be a relaxation for the initial C3PAOs. Assess candidate C3PAOs
to maturity level one or two now, and then require level three
in the future. The requirement for tier three background
investigations for assessment and support staff creates another
bottleneck. I would recommend allowing an interim clearance
process for that.
In conclusion, the majority of the 300,000 contractors in
the DIB are small businesses. Without monetary support and
clear regulatory guidance, the DOD will lose small businesses
as they will look to find business in the commercial sector. A
balance must be struck between risk and cost. Too much cost, we
lose suppliers; too much risk, and we hurt our national
security.
Thank you for allowing me to testify, and I look forward to
your questions.
Chairman PHILLIPS. Thank you, Mr. Singer. And now we
recognize Ms. Wilson for 5 minutes.
STATEMENT OF TINA WILSON
Ms. WILSON. Chairman Phillips, Ranking Member Van Duyne,
and members of the Subcommittee, thank you for the invitation
to testify today. I am Tina Wilson, CEO, T47 International, and
I am honored to have the opportunity to provide some insight
regarding the implementation of DOD CMMC Initiative.
As a business owner with over 260 employees located in 28
States and overseas, T47 provides a variety of staffing
services from budget and finance, janitorial, inventory
management, aircraft tools, maintenance to mail room, and
nonclinical medical and dental case managers. The diversity of
services offered puts me in a unique position to provide a
different perspective regarding this subject.
As CMMC standards continue to be developed and incorporated
into contract agreements and modifications, it is essential
that the Small Business Committee be aware of the policy
impact. If the CMMC standards are not clearly communicated and
monitored for fraud, the financial ramifications to the over
300,000 Defense Industrial Base of contractors, and
specifically to the small business community, could be
devastating.
Based on this statement, I will cover three main subject
areas of concern and offer recommendations.
Cost to secure CMMC. As of today there is no set cost to
obtain CMMC. The CMMC accreditation body has stated that the
marketplace will need to define the cost, which leaves it wide-
open for interpretation what this cost will be. Whether it is a
tiered cost based on the size of the business, or a set cost
regardless of the size, there will be initial and sustained
cost that will impact small businesses' ability to secure the
certification.
A similar certification offered by the International
Organization for Standardization, ISO, is standard 27,000,
which is information technology and focuses on security for any
kind of digital information. This certification costs between
28- to $35,000 to obtain, and takes approximately 6 to 8 months
to implement. This is a tremendous cost burden to add to a very
tight budget for most small businesses.
Cost of not having CMMC. While unknown as of today, what
has been communicated to the entire Defense Industrial Base is
that if you don't have CMMC at the basic level, you will not be
eligible for a Federal contract. Many small businesses may not
even be aware this new requirement and failure to obtain
certification means ending contract work as a service provider
to the DOD.
Additionally, as the prime contractor, it will be our
responsibility to flow down the requirements to our
subcontractors. If the subcontractor does not have
certification, we would be required to end subcontract
agreements to remain compliant with the DOD CMMC standards.
Audit imposters. I raise this subject as an awareness to
inform the Subcommittee. When the DOD presented the CMMC as the
new way of life for all businesses within the Defense
Industrial Base in the summer of 2019, many business owners
asked a lot of questions of why? Who will conduct the
implementation and audit? How much? When will it happen?
Implications, or if you do not have it, and many more
questions.
Before the CMMC accreditation body was formed in the latter
part of 2019, audit imposters with no training and not
accredited, start advertising that they will certify your
company as cyber compliant for thousands of dollars to get a
company ready. For many small businesses that are just now
hearing about this standard, may in a moment of panic and fear
of losing their government contract, may fall prey to an audit
imposter.
As I close, I recommend that the Subcommittee members
closely monitor this very important implementation of CMMC
Initiative. While I know there are so many other issues to
focus on, CMMC has ramifications that reach far beyond what we
can realize at this moment.
It is important that, one, cost is articulated clearly to
reduce price gauging and to allow the small businesses to plan;
number two, a balanced cost approach that does not reduce small
business participation in the Federal marketplace; number
three, DOD continues to work closely with various advocacy
groups to ensure that the Defense Industrial Base contractors,
known at the Office of Small Business, is aware of this
implication to this new initiative; and four, DOD and the
Office of Small Business start as soon as possible to put
various roadblocks in place to reduce the number of audit
imposters.
Thank you for your time in addressing this very important
subject that impacts thousands of small businesses that do
business with the Department of Defense.
Chairman PHILLIPS. Thank you, Ms. Wilson.
And now I recognize Mr. Dunbar for 5 minutes.
STATEMENT OF MICHAEL DUNBAR
Mr. DUNBAR. Chair Phillips, Ranking Member Van Duyne, and
members of the Subcommittee, thank you for the opportunity to
testify before you today. My name is Michael Dunbar, and I am
the president of Ryzhka International, located in Pompano
Beach, Florida.
Ryzhka International provides lubricants, fuel oil in bulk
quantities, package quantities to the Federal Government,
commercial maritime industries. I am a proud service-disabled,
veteran-owned small business, as well as a HUBZone certified
small business.
I am testifying today on behalf of the HUBZone Contractors
National Council, a nonprofit trade association providing
information and support for companies and professionals
interested in the Small Business Administration's HUBZone
program. We would like to thank the Committee for its
commitment to small business and for advancing policies that
support small businesses doing business with the Federal
Government.
In a recent hearing, Deputy Assistant Secretary of Defense
of Industrial Policy, Jesse Salazar, said it best: The
Department's approach to cybersecurity must balance the need
for accountability with the recognition of the challenges
facing small businesses.
Small businesses understand the importance of
cybersecurity, and the very real threats facing their
companies. We are not looking for a way to opt out or ignore
this problem. We want to secure our companies. According to the
DOD's contracting data, 74 percent of the Defense Industrial
Base are small businesses. These contractors are critical to
the government, and are not a group that can be ignored.
The Federal Government has long identified the need to
safeguard sensitive information and understands that
cybersecurity is dynamic issue. Small businesses, however, are
experts on the goods and services they provide. We do our best
to focus on supplying a product, making a profit, and retaining
employees. Most small businesses are not IT professionals. We
are not cybersecurity specialists either. I am--right here is
the assessment guide. This is for cybersecurity CMMC model
level three. It is full of stuff I have no idea and don't
understand. I have to hire somebody to figure this out.
The initial cost for me to start my business was less than
$1,000. The cost to start a new government-focused business
with this, 10,000, 100,000; we really don't know. Access to
capital can be a very challenging issue for small businesses,
and we have to use significant capital now to become CMMC
certified.
The segments hurt most are the segments that can least
afford it. The Federal Government already has challenges
meeting those goals. If we reduce the number of companies that
qualify, you also reduce opportunity for people to start up new
businesses in those sectors.
The council makes the following recommendations to improve
the rollout of CMMC, and maintain a strong industrial base.
Increased cost transparency and put guardrails on rising
compliance costs for small business. One of the biggest
frustrations for small business throughout the rollout has been
cost transparency. Some small businesses have estimated costs
in excess of $100,000 to prepare for level three certification.
That doesn't include the assessment costs. I have heard of
assessment costs already estimated at above $150,000 for a 50-
person company.
Establish clear communication on CMMC efforts. A lack of
transparency, clear, consistent communication by the DOD, and
the rollout of CMMC and its implementation by the CMMC
accreditation body has been concerning. The council suggests
putting together a more clear, consistent delivery of
information through a central government platform or website.
Streamline new and existing standards for contractors. The
Federal Government lacks unified cybersecurity standards across
all agencies. The council encourages the DOD to work closely
with industry, particularly small businesses, to streamline
these requirements allowing companies to have a plan of action
and milestones after a CMMC assessment would help these
burdens.
Create a system for oversight and equitable rollout. Many
small businesses worry that they will be put at the back of the
line and face massive delays as companies serve the
subcontractors, and equitable rollout is important to these
companies as well.
In conclusion, the Federal Government has a long and
complex history of governing cybersecurity regulations and
compliance with its contractors. A streamlined approach needs
to be taken for contractors to navigate all of these standards
and system successfully.
Thank you for the opportunity to testify today, and I look
forward to your questions.
Chairman PHILLIPS. Thank you, Mr. Dunbar, and to all of our
witnesses for being with us today and we appreciate your
testimony on the CMMC Initiative.
I will begin the hearing now by recognizing myself for 5
minutes. I will start with Mr. Williams.
I think we all understand the importance of cybersecurity,
and ensuring that the most vulnerable small businesses in the
DIB supply chain are protected. However, it is clear that the
cost of CMMC could be terribly burdensome for small businesses.
So how should we be looking at this? How can we strike the
right balance between enhancing cybersecurity, and ensuring
that small businesses can participate in DOD acquisitions?
Mr. WILLIAMS. Yes. Excellent question. Thank you. I think
one of my top suggestions there is to try to make good on DOD's
estimate that most small businesses will only need level one.
As I said in my testimony, that is not guaranteed, but if we
can keep as many small businesses as possible at level one,
that will strike the right balance between ensuring that these
small businesses have at least the basic cybersecurity
protections in place, but will allow them to avoid, as Mr.
Dunbar said, the significant additional costs when you go from
a level one to a level three.
And I think managing the level one versus level three
distinction is probably one of the most critical ways to keep
the cost down for small businesses. That could be done through
flow-down protections. Make sure that primes are not flowing
down higher than level one if their subcontractors only need
level one. And I would like to see more flexible approaches
where the small businesses don't need to take the controlled
unclassified information into their own network, because that
is what then causes the jump from level one to level three.
Let's look at ways that either the DOD and their own
systems, or the prime contractors and their own systems, can
maintain this information, and let's maybe be more creative and
flexible in how we allow small businesses to participate on
those programs without having to take that information into
their network, and then cause them to have to go up to a level
three.
Chairman PHILLIPS. Appreciate that. Are there any funding
streams of which you are aware that can help small businesses
with the costs of CMMC? And if there is anything that Congress,
DOD, or even SBA could do to help in that regard, no matter how
significant the expenses might be?
Mr. WILLIAMS. I am not aware of specifically targeted
funding stream at CMMC. I think it would be a fantastic idea if
there was the wherewithal for a grant program for small
businesses to help them on their way with the upfront
investments needed for CMMC.
The larger small businesses will be able to make that
investment and get it on the back end when they are paid on
their contracts with the government, but for the smaller firms,
even the several thousand dollars of the investment needed for
a level one might be too difficult to make upfront.
And I think the existing mentor-protege programs, as I
mentioned, those are fantastic programs. They work very well in
many respects at the SBA and DOD for small businesses and large
businesses. There are a lot of incentives that large business
mentors get from participating in those programs.
We could be clearer, more well-defined that mentors, when
they are permitted to access those programs, have to ensure
that one of the things they are doing for their proteges is to
provide financial resources and technical assistance to ensure
their proteges are ready for CMMC.
Chairman PHILLIPS. Thank you very much.
Ms. Wilson, I would love to hear from you about your
experience. How were you made aware of CMMC? How difficult is
it for you and T47 to understand, and do you envision having to
engage a consultant or specialist to help you navigate it?
Ms. WILSON. Sure. Thank you for the question. I learned
about CMMC when attending a DISA Industry Day in 2019 up in
Baltimore. I understand completely how it works and, you know,
from a broader perspective, but, you know, protecting supply
chain, intelligence, assets, IT infrastructure and, you know,
things that matter to protect in our Nation.
And for T47, the critical part is, we have to secure a
specialist, which I have already engaged, because it is very
complex. And for someone that is non-IT like myself--I am a
business owner. I know how to go get contracts and build a
company, but to build an IT infrastructure that impacts a lot
of employees and be able to maintain it and go into other
secured areas, it is a challenge.
So to actually have an expert to help us is going to be
critical, and I have engaged in that process already.
Chairman PHILLIPS. Thank you very much. My time is expired,
and now I recognize the Ranking Member, Ms. Van Duyne, for 5
minutes.
Ms. VAN DUYNE. Thank you very much. Mr. Dunbar, okay, hold
that up one more time. You need two hands. That is--I mean, I
completely understand your frustration right now. Do you
believe that the CMMC duplicates any of the multiple standards
in cybersecurity programs that currently exist? Do you find
that there is a bunch of stuff that is already existing right
now that is in that book that you are going to have to do more
of? And is there a way to further streamline these disparate
processes?
Mr. DUNBAR. Thank you very much for the question here. From
what I understand--and I am not a technical expert, so I will
answer from a layman's perspective--CMMC added, I believe, 20
additional items to NIST 800-171, which is currently the law of
the land and what exists today. So what is being projected to
be our new standard is built on an existing standard, and part
of me questions why we had to go so much further.
The reasoning behind putting CMMC in place, part of it was
because we were doing self-assessments before for companies
instead of having a third-party assessment. Why could they not
institute some part of third-party assessment to an existing
standard? Why create a whole new standard that people have to
learn and understand to begin with?
And I didn't have to deal with the first standard because
most of my business is what they call is called COTS, which is
Commerical-Off-The-Shelf products; however, fuel recently, as
we just saw with Colonial Pipeline, has become a very critical
item. Is supplying fuel by truck, by whatever method all of a
sudden going to become a CMMC level four like the
infrastructure piece of it might potentially need to be? That
is going to impact a significant number of small businesses
like mine.
So by adding these additional items, we ask our question as
to why, and how do we streamline this? I have in place security
right now that covers 77 of the NIST items--covers 77 of the
CMMC items, but covers 90 percent of the risk. So is that
additional cost-benefit, and we are talking 80 to $100,000 of
additional cost to get that other 10 percent realistic for
small business?
Ms. VAN DUYNE. I am concerned that the critical information
about CMMC is being conveyed in a conflicting and potentially
informal manner. What are small businesses currently going to
seek information or guidance on CMMC? Where are you going to
find more information? And then, what would be the ideal method
or platform of communication from the DOD to the contracting
community? How can we make it easier?
Mr. DUNBAR. The main place that we have been receiving
information tends to be LinkedIn. We have had members of DOD
communicating directly through LinkedIn, members of the CMMC
board communicating through LinkedIn. That tends to be the
largest location or community of folks getting information on
this program. We get very little from DOD directly. They have
had some town halls that they call it. You don't really get
much notice, if any.
Just the other day was mentioned a project spectrum, I
believe it is called, that I had never heard of, that was put
in place, it looks like some time in 2020. Most small
businesses are unaware of this as well, and this is supposed to
help us somehow, it is a DOD program, but we are not even aware
of it.
Ms. VAN DUYNE. Your being sent to a website is probably not
going to help you?
Mr. DUNBAR. Correct. And that is just--there is no
consistent method or message coming out from DOD on where to
get things. Even if you go to the CMMC-AB frequently-asked-
questions page, sometimes they say Oh, that is a DOD
responsibility, and that has been a lot of the kickback is
pointing fingers between the CMMC-AB and DOD saying, Well, they
are responsible for X; they are responsible for Y.
Ms. VAN DUYNE. Specifically for the small business
community, I didn't mean to cut you off, if you had anything
else to add.
Mr. DUNBAR. No, ma'am.
Ms. VAN DUYNE. Specifically for the small business
community, and I hate to add another agency in here, but do you
see a role that SBA could possibly play in helping to be an
intermediary between the three?
Mr. DUNBAR. I definitely--there should be a role for the
SBA in here. I don't feel that the SBA has been able to be
involved. I feel that the DOD has sidelined them, at least in
my opinion, in the same manner that I think a lot of small
businesses have been ignored when we have raised questions or
raised issues. And that has basically been kept to a very small
group of people that are running all of this, and then we get
told later on, Here is what is happening.
Ms. VAN DUYNE. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentlelady's time is expired.
And now I recognize the gentleman from Pennsylvania, Mr.
Evans, for 5 minutes.
Mr. EVANS. Thank you, Mr. Chairman. I would like to ask a
question to Ms. Wilson. Small businesses are frequently
targeted by cyber criminals. What would the ideal situation be
for you in terms of the Department of Defense ensuring that
cybersecurity taken care of its small business base?
Ms. WILSON. Thank you so much, sir. I think one simple
solution to offer, and it could be reasonable cost and possibly
free. It is the offer of maybe cyber tools that are already
approved by DOD to the small business community as a first line
of defense. It could be offered up from the CMMC level one up
to possibly level two. And then, at least this way, DOD has a
level of comfort to say, Okay, at least we have some tool out
there now, it is up to the marketplace, the small business
community to go out and secure additional certification, if
necessary, to ensure that, you know, at least we are taken care
of, and that shows an effort that the DOD cares. That is a
critical part. We just need to know that DOD is here to help
you.
Mr. EVANS. I would like to follow up. For many small
business, cybersecurity certification is just one of the many
requirements of certification they need to comply with as part
of being a defense contract. Can you mention just a few of the
other certifications you have to comply with, and how does the
cybersecurity certification compare to other certification in
terms of its levels of burdens?
Ms. WILSON. Sure, sir. So for T47, we have actually
invested in securing the ISO certifications, three
certifications. We are doing that currently. That is a very
costly investment. We will also have the SBA 8(a) certification
that is due annually. And because of our size now, we now must
incur additional cost for audits that are necessary to keep the
certification.
We have the woman-owned small business certification, and
then as a clear facility, we have the defense
counterintelligence security certifications as well to keep our
clearance.
So, in comparison to all those other certifications was
just a small list for us. To be perfectly clear and frank with
you, the CMMC has been the most challenging, because it is just
a lack of not understanding exactly what is needed, and it is a
cost that is involved. There is no transparent cost set aside
for, like, small business mid or large.
And I know this is a new initiative because any time you
roll out a new policy, there is always going to be bumps in the
road, but at the same token, there needs to be more of a clear
communication from DOD, and those that are managing this
process on what it is going to take for small businesses, or
all businesses to have the certifications necessary.
And that is going to take a concerted effort for everyone
to understand. CMMC, to be quite honest with you, it is new,
but it is a challenge. And it must be worked out pretty quick
because you are going to start rolling these things out into
contracts, and the fear could be real once it starts happening.
Mr. EVANS. I thank you.
And I yield back the balance of my time.
Thank you, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And now I recognize the Ranking Member of the Subcommittee
for Underserved, Agricultural, and Rural Business Development,
Mr. Hagedorn of Minnesota for 5 minutes.
Mr. HAGEDORN. Mr. Chairman, thank you for that, Ranking
Member Van Duyne. It is good to be with you today. Thanks to
the witnesses. This seems to be one of these issues, and even
the big agencies the Federal Government want to impose a lot of
things on small businesses that they themselves don't handle
appropriately.
It doesn't take--you don't have to think too long and hard
to realize that the DOD has lost technology outright, giving it
away in some cases, our Federal Government, to China. Economic
technology, of course, gets lost a lot by big companies. OPM
went and took 25 million records of Federal employees. I was
one of those folks that they stole from during the Obama
administration, and now they come along and say, Well, if you
want to do business with us, you have to go through a bunch of
gyrations, spend a bunch of money, and some of it, it seems,
could be reasonable.
You look at recently, we had some issues with, obviously--
and these things are very important. We had a big meat packing
company that does 25 percent of the beef in the United States;
have a pork manufacturing plant in Worthington, Minnesota,
where I represent, they went down and you see how critical
things can be. We can lose our food supply and everything else
in the blink of an eye, but Mr. Dunbar, I think--wouldn't it
make more sense if the Federal Government just imposed some
reasonable standard and said if you want to do business with
us, you got to try to do everything possible in order to make
sure there is security here, and that you protect these digital
ways that you do business? I mean, rather than have you go
through all these hoops. I mean, you say it costs up to
$100,000, it doesn't seem reasonable to me.
Mr. DUNBAR. Thank you, sir, for the question. Yes, I agree.
I think the keyword there is the definition of reasonable. I
believe the DOD believes that their numbers and that their
requirements are reasonable. Small businesses would probably
disagree with that when you have a company like mine of six
people that has to spend $100,000 to comply with something.
There are, as I mentioned, standards out there currently
that are being used every day. I mean, right now, a small
business--you walk into a small business and we hear
advertisements on TV and such saying, We have got your
security, Have your internet service through us, we got you
covered. Well, that is what a small business thinks. Okay. They
got our security for us. No problem. Then we see something like
this and say, Well, we really don't have security, do we? We
need something in between those two items.
My security that I currently have in place is, as I
mentioned, covers 77 of the items that are being requested in
90 percent of the problems, and it is costing me about $15,000
a year to $20,000 a year to do that. I could get away with a
little bit less, but I have insurance and other things on it
that get tossed into there to cover in case I get hacked.
So there are standards out there that could cover
reasonably well what we are all looking for, and meet a level,
I think, that would provide security for anything but the
greatest items out there. As was mentioned by Mr. Williams,
having access into a system provided for us for companies that
don't need to take something or machine it, but actually just
need that data and that information can go into the government
system sort of like the National Guard does. They have their
little wall garden, we call it. A member of the National Guard
can go in, get their CUI information in there, go out, be it
their VPN, and now they have all the information that they
need, and it has been in a secure environment.
Mr. HAGEDORN. So I worked a little bit in the Treasury
Department, and I have seen bureaucracies in action and usually
the bureaucrats come up with lots of ideas in order to make
sure that if something goes wrong they can, as you say, point
the finger at somebody else. And I see a lot of that here. I
see a lot of expense being pushed along to you, and just
because if something goes wrong, they don't want to be blamed
for it.
And I think, you know, it is kind of telling when
government comes up with these ideas here, we are going to put
this regulation on you, we are going to make you do all these
types of things, and oh, it is going to cost some money so,
well, now let's go find funding streams in order to help you
pay for that. I mean, we see this all day long.
I think a reasonable standard would make sense. Most
businesses, even the big ones, have issues here. They all need
to do better in compliance and I think that people can figure
that out. So thanks very much, by the way, for your service to
the country and you had a very impressive resume. Took our
Ranking Member an extra shot at it just to get it out.
Thanks very much.
Mr. DUNBAR. Thank you, sir.
Chairman PHILLIPS. The gentleman yields back.
And now we recognize the Ranking Member of the Subcommittee
on Economic Growth, Tax, and Capital Access, Mr. Meuser, for 5
minutes.
Mr. MEUSER. Well, thank you, Mr. Chairman. Thank the
Ranking Member very much for holding this hearing. Thank you to
the witnesses as well. So there are reports--we all know that
cybersecurity is clearly an issue. Reports are, that I have
reviewed, that 6 percent of U.S. military and aerospace
contractors reported data breaches between 2016 and 2018.
Ransomware attacks are up over 100 percent in 2020. All
industries, by the way. That is for all industries. So it is a
concern.
DOD, however, seems to have created the CMMC mandates that
are a major concern to all small businesses and contractors
certainly sitting here, and in my district. In fact, it seems
that some of the focus on compliance with these mandates is
even truncating your actual ability to focus on actual
cybersecurity. And as being in business for a lot of years, I
understand that. These mandates coming from Washington, in this
case the Department of Defense, don't take what your business
about fully into consideration. How could they possibly, right?
I mean, it is a one-size-fits-all approach.
So, I am definitely not happy to hear that the Department
of Defense is also not offering forums to have this discussion
with you, right? Perhaps in a hearing maybe we can do that or
create access so they can better understand your concerns. And,
again, I have DOD suppliers in my district that have already,
just in the last couple of years, spent tens of thousands of
dollars living up to these requirements and trying to achieve
them. And meanwhile, they don't necessarily even know what
level they are at, and they are very concerned, even their
midlevel suppliers of those who are supplying them, being able
to maintain those costs. Everything that you are discussing
sharing here.
So Mr. Dunbar, I will just ask you this: Level one, we are
talking about level one here, what is--do we have the
Department of Defense's feedback on if level one is
satisfactory, and for how long it will be because I know they
are trying to roll into this with a--in a managed way over the
next several years, right?
So what do they say about you and suppliers that you know
about maintaining level one at this point?
Mr. DUNBAR. Well, I think you reached part of the problem,
is we are not really hearing a lot. We have got some estimated
dollars and some numbers out there tossed around to level one,
and yet how long is it supposed to last, any of the real detail
on it? We don't get a lot of that. As you mentioned, the
technology, is that going to keep up, or are we going to keep
chasing technology as we go along, and, therefore, chasing more
regulations and more rules that we have to get reassessed for
along the way which are just going to continue to increase
costs?
Mr. MEUSER. Speaking of cost, what is the cost difference,
would you estimate, from level one, which many are saying here
they believe would secure your systems and your companies
versus say level three? Can you put a number on that?
Mr. DUNBAR. Easily ten- to twenty-fold.
Mr. MEUSER. Wow. Okay. And how much more secure would it be
from level one to level three?
Mr. DUNBAR. I don't really know specifically from a level
one to level three how much more secure it would be. I know
from where I am currently, and what I am paying for the setup I
have, which is a pretty secure setup, according to--the person
who handles my security is actually a past director at DCISC
for the Department of Defense, so he is the one who set mine
up, and he is the one who said that we have 77 of the 120
controls and have 90 to 95 percent of the issues.
So he believes for very small companies that you could be
looking at, you know, 5 to 10,000 a year maybe for your costs
instead of, you know, having to reach up to this level and that
same company could be at hundred-plus thousand dollars a year.
Mr. MEUSER. Well, I think we can conclude that these
measures are overly harsh and we do need to create a forum to
have this discussion with DOD so we can work this out.
I yield back, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And that completes our first round of questioning. So,
therefore, I will recognize myself for another 5 minutes.
Mr. Singer, while companies like yours in the pipeline
become accredited C3PAOs, there is a long ways to go until we
have a substantial amount of them. So how likely is full
implementation of CMMC by 2026, if there is a lack of
assessors?
Mr. Singer?
Mr. SINGER. I forgot to unmute.
Thanks for the question, sir.
I think it is very difficult to get there with the current
progress we are making. We have a hundred provisional assessors
at this time, and we have two C3PAOs already through the
process from doing a DOD assessment. And, by the way, the
third-party assessors are going through that level three
assessment, so we have to meet the 130 different practices.
So I think it is very difficult. The timeline is very
stretched. As I had said in my testimony, I think we need more
than 8,000 assessment team members to even make this happen,
and that would be starting from today. So the math just doesn't
work. I believe that there does need to be some flexibility in
how we are rolling this out to the third-party assessors, and
we need to have some--you know, if we are going to try and meet
that deadline, there needs to be quite a bit more flexibility
by the DOD in trying to ramp this up and move this out.
I also feel pretty strongly that not everybody, as we have
talked about before, needs to be at level three. If you are a
part component maker, a small business, and you are doing, you
know, special processes like coatings, painting, and somebody--
a prime flows down a drawing to you and tells you, Put the
label plate here on this, you know, equipment, all of a sudden
you have now had to hit level three.
So there is some work here that needs to be done on
understanding the risk truly to the supply chain, and maybe a
single part maker of a bracket doesn't need to be level three,
but somebody that is making sub assemblies and more complex
parts does need to be.
So that would be my answer.
Chairman PHILLIPS. Thank you, sir.
And, Mr. Williams, while CMMC is a DOD initiative, we are
beginning to see it in other solicitations, particularly for
government-wide contracts like GSA's 8(a) STARS III contract.
So how concerned should small businesses be of the CMMC
Initiative being adopted by civilian agencies and becoming a de
facto baseline for doing business with the Federal Government?
Mr. WILLIAMS. Yes, I think that is certainly a possibility.
You know, the rollout with CMMC at DOD has experienced
challenges, as we have been covering in today's hearing, and I
think it remains to be seen if they will hit the target of 2026
as Mr. Singer just said. I would view what is happening at DOD
as a trial balloon. And if it went well at DOD, which certainly
is an open question at this point, I wouldn't be surprised at
all if it is expanded beyond DOD to all of government.
Chairman PHILLIPS. All right. Thank you, sir.
And with that, I will now yield to Ms. Van Duyne for 5
minutes.
Ms. VAN DUYNE. Thank you very much.
Mr. Singer, I appreciate your testimony here today. I just
have a couple of questions.
What is the penalty or the outcome for a small business
that can't comply with the requirements?
Mr. SINGER. Today, the penalty is that you are out of doing
business with the DOD, period.
Ms. VAN DUYNE. Okay. I mean, that is--I am seeing Mr.
Dunbar shake his head as well.
So I am going to ask actually the whole panel, can you
point to one or two concrete things that we can do to make
understanding these flow-down requirements easier for small
business? Mr. Hagedorn had a great point, well, yes, we could
just define reasonable and move forward from there. Can we be a
little bit more specific on what you would need?
And, Mr. Singer, we will go ahead and start with you.
Mr. SINGER. Sure. Thanks for the question.
I think it is really--I think the primes really need to
step up and play a bigger role here. They have the resources
and the teams, and they have done a lot of the background work
on understanding what is required. And instead of just sending
out a rep and certs or a letter to a small business saying you
need to post a score in the supplier performance risk system, I
think there needs to be more support and help for them and more
of a guiding kind of process program that they implement for
their whole supply chain to help them get compliant.
Ms. VAN DUYNE. Ms. Wilson, do you have anything to add?
Ms. WILSON. Yes, ma'am.
To ensure that everyone is on the same page and have the
same information. What we have right now is pockets of
information going to various individuals, like I just heard
from Mr. Dunbar, said most of the information is being flowed
through LinkedIn. Some companies have LinkedIn and some
companies do not. There needs to be concerted effort of
communicating what the standards will be, what the costs will
be across all industry, and filter down to the small business,
and maybe a regional approach to be able to help understand
that CMMC is here to stay, take away the fear, but communicate
clearly what it really means to have this certification.
Ms. VAN DUYNE. Awesome. Thank you.
Mr. Williams?
Mr. WILLIAMS. Thank you.
Yes, I would like to make two points. First to address the
comment about flow down. The interim DFARS clause for CMMC
which was issued late last year directs prime contractors to
flow down the CMMC level that is appropriate for the
information that is being flowed down to the subcontractor.
That gives a lot of discretion to the prime contractor to
decide what is appropriate. I would like to see the final DFARS
clause for CMMC prohibit prime contractors from flowing down a
higher level than is absolutely necessary based on the
information that is being provided to the subcontractor.
And the second point I would like to make about the
information that is being disseminated to the small business
community, my experience has been that there have been town
halls, as Mr. Dunbar mentioned, and I get the LinkedIn messages
as well. There are other ways that information is being pushed
out, but I think the problem--the challenge is that that
messaging is blunted by the fact that we still have no answers
for many of the critical questions.
So rather than focusing on creating more forums for
disseminating information, I think we need to focus on
providing real hard information about how much this is going to
cost and when are small businesses going to need it, what level
are they going to need? Until we can answer those basic
questions, I think, you know, the forums are going to be
largely lost on the small business community.
Ms. VAN DUYNE. Thank you very much, Mr. Williams.
Mr. Dunbar, did you have anything to add?
Mr. DUNBAR. Yes. One of the items with small business is a
lot of small businesses work from, I will say remote locations.
You may have an office where you have people working from home,
several people at various homes. One of the big items that was
brought up recently by one of the board members for the CMMC
was that we will be subject to home inspections in order to
pass CMMC.
So now you have people doing home inspections in your own
private homes. The risks beyond that on there are just, you
know, incalculable.
Another item to me that really piqued my interest there was
our ability to protect ourselves during an assessment. Right
now, an answer on the Board FAQ site basically states that an
RP that helped us go ahead and put together our plan is not to
be there to defend our plan. So if we get--you know, fail it,
we are supposed to know this book again. We don't have an
expert to know it.
Ms. VAN DUYNE. Excellent. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentlelady yields back.
And now I recognize the gentleman from Pennsylvania, Mr.
Evans, for 5 minutes.
Mr. EVANS. Thank you, Mr. Chairman.
Mr. Dunbar, what would you--what would be your
recommendations for those businesses that are just learning
about the Initiative? I would like to ask all of the panel that
question.
I will start off with you, Mr. Dunbar.
Mr. DUNBAR. I honestly don't know that I have an answer for
that, because trying to know find the information, it has not
been clear enough to everybody where to get it. If I am getting
it from LinkedIn, I mean, I first heard about it at an Army
Corps Small Business Conference in 2019. Otherwise, I may not
even know about it today.
Mr. EVANS. Does any other panel--any comments or thoughts
on that, any of the other panelists?
Mr. SINGER. Sure, sir, I would like to make a comment.
You know, I think one of the important things is for
companies to find reputable businesses to help support them
through this process, and, unfortunately, I think there is too
much variation in the help that they are getting, as Ms. Wilson
spoke of earlier also.
I think also that, especially now, I think a lot of the
level three companies are aware of this coming down, especially
small manufacturers that are, you know, just now starting to
really understand this because the letters are coming out from
the primes.
But I think a big gap is the people that are going to have
to meet level one and they don't know it right now, and I think
that should be a much more proactive reach-out to those folks.
I mean, the DOD knows who they are contracting with in these
areas, and I think they should take a more active role.
Mr. WILLIAMS. Yes, Representative Evans, if I could just
back up Mr. Singer's comments there, our primary recommendation
to our small business clients is to get level one ready. The
level one requirements really are basic things, like antivirus
software and spam filters that we think all companies should be
doing, regardless of whether you work with the Federal
Government. In this day and age, you should be doing at least
those basic requirements, and they are already in the FAR. The
FAR requires these basic safeguards. That has been the
requirement for a long time.
So, this really, frankly, shouldn't be surprising, but I
totally recognize that it is, because small businesses have so
much to focus on. But these requirements are not new, and they
are, generally speaking, not difficult to obtain for small
businesses. So, we would like everyone to really focus on at
least getting level one ready, because these are things you
should be doing as a business.
Ms. WILSON. And I would echo everyone's comment that has
been made on the panel. I do make a concerted effort to share
with small business owners to mention CMMC, and I mention it in
the context of the necessary need for them to actually have it,
but understand what it means and the implications, because
right now, we just have black and white implications of saying
if you don't have it, and your contract comes up for renewal,
then you run the risk of losing your contract.
And, so, putting that fear in them early on, maybe prompt
them to move forward. But also I think from our perspective at
T47, we have already proactively tried to secure something
similar, certification. It may not be directly related, but to
at least get us ready so that way when it comes down for us to
have an audit, we are in a position to actually, pass the
audit.
So it is a challenge, and right now, because we don't have
cohesiveness of information, it makes it a little more
difficult for small businesses that just now are recognizing
that they need it, or they know they need it but don't know how
to secure it.
Mr. EVANS. I yield back, Mr. Chairman.
Chairman PHILLIPS. The gentleman yields back.
And now I recognize the gentleman from Wisconsin, Mr.
Fitzgerald, for 5 minutes.
Mr. FITZGERALD. Thank you, Mr. Chair.
I am going to start, Mr. Singer, as a fellow Wisconsinite,
I have quite a bit of experience in working with obviously
anywhere from major corporations down to, you know, one and two
person Ma & Pa shops. But my question, I was talking a little
bit to staff about this yesterday. We were kind of kicking
around the idea that there might be a different level of
security from State to State throughout the Nation, and I just
wanted to get maybe your perceptions on, is there much
interaction with the State of Wisconsin from your perspective?
And if there are, what are the influences there? Because I
think it would be valuable for Members of Congress to know kind
of what is going on at the State level.
Mr. SINGER. Thank you, sir.
As a fellow Wisconsinite, it has been kind of fun starting
a business in Wisconsin, and Minnesota too. But as far as--I
haven't had a lot of interaction with the State government. I
counseled them a little bit on CMMC. It has been new to them,
in helping them to try and understand the issues around this
for small business.
One of the organizations that we work very closely with are
the MEPs, the Manufacturing Extension Partnership programs.
Every State has one. There is--and Puerto Rico has one. We have
been working very closely with them to try and help get the
small manufacturers in Wisconsin and Minnesota through the
assessment so that they can accept awards from the primes.
So I think that is really actually a good avenue to help
small businesses is through the MEPs, especially the
manufacturers. But I don't know that, you know, the States yet
have really kind of figured out any good mechanisms to help
fund or support the small businesses as of yet.
Mr. FITZGERALD. Very good. Thank you.
As anybody could probably answer this question, let me just
direct it to Mr. Dunbar, though. And I apologize if some
version of this was asked earlier. But cybersecurity,
obviously, you can be a consultant, quote/unquote
``consultant,'' and I am wondering if you are seeing, because
we are starting to hear that there are many different versions
of this, and obviously many different levels of professionalism
and knowledge.
And I am just wondering if you could comment kind of, you
know what is your take, kind of what is going on out there on
the street?
Mr. DUNBAR. Thank you, sir.
Yes, you are 100 percent correct. There is a large fear in
the small business community that the ``consultants,'' in
quotations, are not all equal. I get inundated with emails
daily from companies trying to convince me that I am not ready,
I need to be--I am losing my contracts. I mean, blatant lies in
your inbox constantly from companies. I call it the fear
marketing.
I have also seen things from--as one of the other members
of the committee had mentioned earlier, you know, companies
that--there are fraudulent companies out there, just that have
no business. There was one, I think, the College of India was
creating, We can get you CMMC certified.
Mr. FITZGERALD. Right.
Mr. DUNBAR. Like, okay, great. How is the College of India
getting me CMMC certified? And that is a fear. We don't know
where to go. We have been told, Oh, well, the only great place,
the only authorized place is the CMMC-AB, if they are on their
marketplace, that is the only place to get, that is legal, to
get your consulting from. That is a whole separate issue, I
believe.
Mr. FITZGERALD. Yes. And, you know, to dovetail on that, so
compliance, too, because it is kind of wide open as to what the
cost could be associated with that. You know, you hear figures
thrown around, like, Well, it costs a company $10,000 to
comply, or it costs them $1 million to comply. That is not
necessarily a good gauge, I don't think, on, kind of, you know,
whether or not somebody is a legitimate consultant. But it
sounds like that is kind of the range that is out there when a
lot of these small businesses are considering how to become not
only compliant, but protect ourselves, so----
Mr. DUNBAR. And I think you raise a good point because
there is also a lot of companies out there trying to sell one-
stop shopping, like, Oh, we have this program. You buy this
program, you are CMMC-compliant.
Mr. FITZGERALD. Right.
Mr. DUNBAR. And that is not going to happen.
Mr. FITZGERALD. Yes. Very good. Thank you very much.
I yield back.
Chairman PHILLIPS. The gentleman yields back, and that
completes our questioning.
So I will move to my closing statement. And I want to thank
all of our witnesses for a very compelling testimony today and
for illuminating the very issues that small contracting firms
are experiencing as they try to bolster their cybersecurity.
Recent high-profile attacks have made it very clear that
the threat of malicious cyber actors is growing, and that is
why we must ensure that companies in the DIB are prepared for
all cyber threats that might come their way. But it is equally
vital, equally vital that we do not deprive businesses like
yours of critical opportunities in that process.
We have got to work as a committee to increase
cybersecurity preparedness across the DIB in a way that is not
cost prohibitive to small firms. By achieving this, the small
businesses will still have ample access to a lucrative
marketplace while also protecting themselves against 21st
century threats.
I would ask unanimous consent that members have 5
legislative days to submit statements and supporting materials
for the record.
Without objection, so ordered.
And if there is no further business to come before the
committee, we are now adjourned.
Thank you.
[Whereupon, at 11:17 a.m., the subcommittee was adjourned.]
A P P E N D I X
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]