The Pitfalls of Factoring in Security and CMMC Costs.

• Date: 01 June 2021
• Author: Tomaselli, Michael,Battad, Charles,Tomaselli, Michael^Battad, Charles
• Published date: 01 June 2021
• Author: Tomaselli, Michael

The need to elevate security as a primary metric in Defense Department acquisitions--along with cost, schedule and performance--will invariably require that the government's perspectives on procurement costs be recalibrated.

It is a certain truth that enhancing security for contractor networks and systems and incorporating security into development and operations, will increase costs for contractors performing on defense contracts.

The requirements, including Defense Federal Acquisition Regulation Supplement clauses 252.204-7012 and 252.204-7021, have already resulted in increased costs for contractors. The former requires the safeguarding of Covered Defense Information through the application of the security requirements set forth in Special Publication 800-171 of the National Institute of Standards and Technology, while the latter sets forth the Defense Department's Cybersecurity Maturity Model Certification (CMMC) requirements.

Costs to address the requirements are expected to grow as cybersecurity threats increase and organizations are forced to continually evaluate and remediate identified vulnerabilities, as well as demonstrate compliance with evolving standards.

Katie Arrington, chief information security officer in the office of the undersecretary of defense for acquisition and sustainment and the driving force behind the CMMC program, has publicly stated that "security is an allowable cost." But such assurance does little to assist contractors in understanding how the department expects the costs to be accounted for.

To date, specific guidance related to the requirements has not been issued by the Defense Contract Audit Agency, though it can be expected that they will scrutinize any cyber-related cost increases being passed onto the government. Prior experience has made contractors all too aware of the risks of making assumptions on the appropriate methods for accumulating and allocating costs under cost-reimbursable contracts. Given current circumstances, contractors should be aware of and consider existing regulations, including the Cost Accounting Standards and the Federal Acquisition Regulation Cost Principles, as well as legal precedent that may guide them in the absence of further guidance from the government.

To conform with contract requirements, vendors are incurring additional costs to enhance cybersecurity capabilities and architect secure enclaves, whether on premise or in the cloud. While certain costs will be non-recurring, such as hardware upgrades and related engineering...