Beyond The CMMC: New Cybersecurity Assessments For Government Contractors

The General Services Administration (GSA) recently announced changes to procedural guidance that may affect contractor eligibility for GSA contracts. GSA issued the IT Security Procedural Guide: Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations Process CIO-IT Security-21-112, which set out a cybersecurity framework for protecting CUI that is similar to the Cybersecurity Maturity Model Certification (CMMC) for DoD contracts. The guidance sets forth both substantive cybersecurity requirements and an assessment process for those cybersecurity requirements, but differs from the CMMC in several important respects.

First, regarding substantive cybersecurity requirements, the guidance incorporates controls from NIST Special Publications 800-171 rev. 3, 800-172 rev. 3, and 800-53 rev. 5. This incorporates far more controls than the CMMC program, which is currently limited to controls from NIST SP 800-171 rev. 2. Second, unlike the