CMMC claims by IT firm reflect tensions amid upcoming cyber certification

摘要

An information technology company's adjustment to its claims about cybersecurity certification under an emerging Pentagon program reflects tensions in the marketplace, as the Defense Department aggressively pushes forward on landmark requirements and businesses strive to keep up in preparing for compliance and new clients. Within that context, RigNet issued a statement this week saying it had achieved level five of DOD's Cybersecurity Maturity Model Certification — the highest level of the five-tier certification process, which is still being developed ～ but issued an addendum the next day clarifying the company had implemented the security requirements without yet having been audited. "RigNet has also instituted the 171 practices to meet Level 5 under the Cybersecurity Maturity Model Certification (CMMC)," the company said in its March 25 update to its press release. "While there are currently no formal, third-party certifications for the CMMC, RigNet is prepared to be certified at the highest level when third party certification becomes available. The CMMC is designed to provide increased assurance to the DOD that a Federal Contractor can adequately protect Controlled Unclassified Information (CUI) at a level commensurate with the risk," the company said.