Dive Brief:
- Many federal contractors are initiating Cybersecurity Maturity Model Certification audits even before the Pentagon’s assessment program fully takes effect, according to a newly published report by enterprise software firm Deltek.
- Nearly 70% of companies that expect to be covered by CMMC — the military’s suite of cybersecurity requirements for defense contractors — plan to undergo a third-party audit this year.
- More than half of all respondents to Deltek’s survey (55%) said they expected CMMC to cover them, but roughly a quarter of respondents said they didn’t know if it would.
Dive Insight:
CMMC launched in December following years of revisions, but the Defense Department expects to roll the program out over a three-year time frame. Still, with companies now eligible for level 2 assessments, many contractors aren’t waiting to get audited.
This trend is likely driven by companies’ expectations about the criteria they will need to meet — of the companies that said they expected CMMC to cover them, 43% said they anticipated needing a level 2 certification (a tier the Pentagon describes as demonstrating “broad protection” of sensitive data), while 34% said they anticipated needing a level 3 certification (which DOD describes as demonstrating “higher-level protection” against sophisticated hackers).
Technology purchases, infrastructure upgrades and policy development topped the list of factors contributing to CMMC implementation costs, according to Deltek’s report, which surveyed 890 government contractors throughout the month of January. Nearly half (45%) of medium-sized businesses reported hiring outside consultants to help them prepare for their audits.
Deltek’s report also asked contractors about other areas of their business, including their technology investment priorities. Artificial intelligence topped the list, with 41% of contractors saying they planned to invest in it (18% said it was their top priority), followed by cybersecurity, at 32% (with 12% listing it as their top priority). Data management, business automation and cloud infrastructure rounded out the top-five list.
