Cybersecurity Maturity Model Certification

As part of our shared commitment to national security, we are writing to bring your attention to the evolving cybersecurity requirements for government contracting known as the Cybersecurity Maturity Model Certification (CMMC). This program is a mandatory framework for all contractors and subcontractors who work on DoD projects. Its goal is to protect government information from increasing cyber threats.

What This Means for You

The CMMC requirements are being phased into all new DoD contracts. Compliance will be essential for any company that wishes to continue working within the Defense Industrial Base (DIB) and BL Harbert International, LLC. The specific requirements depend on the type of information your company handles:

• If you handle Controlled Unclassified Information (CUI): You will need to meet CMMC Level 2, which aligns with the well-established NIST SP 800-171 standard. This level may require a third-party assessment in the future, depending on the contract.

Our Commitment and How We Can Prepare Together

B.L. Harbert is subject to these regulations and is proactively taking steps to ensure our own compliance, including having recently achieved CMMC Level 2 Certification. We view this not just as a requirement, but as a collective responsibility. Our goal is to ensure that our entire supply chain is secure and prepared, allowing us to continue winning and executing important projects together without disruption.

While we are not asking for a formal questionnaire at this time, we strongly encourage you to begin familiarizing yourself with these upcoming requirements. The foundation for CMMC is the existing NIST SP 800-171 standard, and understanding your organization’s alignment with it is the best first step.

Recommended Resources

The DoD and other organizations provide numerous free resources to help businesses understand and prepare for CMMC. We highly recommend you explore them:

• Project Spectrum: A DoD-sponsored initiative providing free cybersecurity training, tools, and information for DIB companies.
  • https://www.projectspectrum.io/
• NIST Manufacturing Extension Partnership (MEP): Offers cybersecurity resources and assistance for manufacturers and small businesses.
  • https://www.nist.gov/mep/cybersecurity-resources-manufacturers
• The Cyber AB Marketplace: A resource for finding authorized CMMC assessors and consultants.
  • https://cyberab.org/marketplace/

We value your partnership and are dedicated to navigating these new requirements together. By taking proactive steps now, we can ensure our collective success and security for years to come.