DoD Warns Against CMMC Fraudsters:
Memo to all companies within the Defense Industrial Base (DIB): you cannot reach CMMC certification – yet!
Today, DoD contractors of all sizes should identify the CMMC compliance level they need to reach, plan for performing a gap analysis and then remediating those gaps, but that’s all they can do for now. the roadmap they will follow to fill those gaps.
Why? Because as of yet there are no auditors.
What’s happening right now in the world of CMMC compliance is this: the Department of Defense is still in the process of finalizing the CMMC accreditation body.
It is that accreditation body which will then train the many CMMC auditors, which will be known as third-party assessment organizations (C3PAO).
Only once those C3PAOs have been trained, which won’t happen until this summer, at the earliest, will defence contractors be able to then be audited and certified.
This is why DoD Under Secretary Ellen Lord warned this week about companies that are claiming to be able to provide CMMC certification to contractors. Not true!
In her words:
“Unfortunately, the Department has learned that some third-party entities have made public representations of being able to provide CMMC certifications to enable contracting with DoD. The requirements for becoming a CMMC third-party assessment organization (C3PAO) have not yet been finalized, so it is disappointing that some are trying to mislead our valued business partners. To be clear, there are no third-party entities at this time who are capable of providing a CMMC certification that will be accepted by the Department.” (source)
That accreditation body should be formalized soon. At that point, auditors who can provide certification will start being trained.
Status Of CMMC Certification:
Although it will be available sometime around mid-year, reaching CMMC certification is not possible today.
So again: can and should DoD contractors be preparing now for CMMC compliance right now? Yes, and they can take every step up to the point of being audited for certification.
But any company that claims it can get your organization to CMMC certification today is telling a whopper.
Now you know. 🙂
