Mary Beth Bosco is a Partner and Norma Krayem is a
Senior Policy Adviser in our
Washington D.C. office.
The defense contractor community is buzzing about a recent
announcement by Katie Arrington, the Special Assistant to the
Assistant Secretary of Defense for Acquisition for Cybersecurity.
The announcement? The costs of achieving compliance with the
Department of Defense (DoD) cybersecurity requirements will be
allowable in certain cases. While there have been arguments that
cybersecurity costs could be included in overhead, Katie
Arrington's statement is significant because it ends the debate
(at least with respect to DoD).
The application and scope of the ability to charge cybersecurity
compliance costs to DoD, however, remains unclear. DoD's
decision concerning these costs is tied to the rollout of its
Cybersecurity Maturity Model Certification (CMMC) Program. The CMMC
Program's objective is to establish uniform standards against
which DoD contractors'
