๐๐จ๐ฐ ๐ฅ๐จ๐ง๐ ๐๐จ๐๐ฌ ๐ข๐ญ ๐ญ๐๐ค๐ ๐ ๐๐จ๐ฆ๐ฉ๐๐ง๐ฒ ๐ญ๐จ ๐ ๐จ ๐๐๐ง๐ค๐ซ๐ฎ๐ฉ๐ญ ๐ข๐ญ ๐ฐ๐ก๐๐ง ๐๐๐ง’๐ญ ๐ฐ๐ข๐ง ๐ฐ๐จ๐ซ๐ค?
One year? Two? Three?
Let me tell you a story about how a system of perverse incentives caused our current cybersecurity situation in the Defense Industrial Base.
Back in 2017 (six years ago), new and renewing DoD contracts started including the DFARS 252.204-7012 clause. The intent of adding the 7012 clause to new contracts was to get defense contractors to increase their bid to account for increased cybersecurity costs (typically double or triple what a commercial company spends on IT).
So in 2018, a new contract comes out for bid. The contract asks for parts which costs roughly $1m to create. The contract also asks for cybersecurity, which would require an additional $500k to comply with.
Ten companies bid on this contract.
Five companies carefully read the contract, see the 7012 clause, contact a cybersecurity consultant to understand what it means, and adjust their bid from $1m to $1.5m.
The other five companies, for various reasons, disregard the 7012 clause. They bid only based on the cost to manufacture, which is $1m.
Who wins that contract?
Who wins the next contract?
And the one after that?
๐๐จ๐ฐ ๐ฅ๐จ๐ง๐ ๐๐จ๐๐ฌ ๐ข๐ญ ๐ญ๐๐ค๐ ๐ ๐๐จ๐ฆ๐ฉ๐๐ง๐ฒ ๐ญ๐จ ๐ ๐จ ๐๐๐ง๐ค๐ซ๐ฎ๐ฉ๐ญ ๐ฐ๐ก๐๐ง ๐ข๐ญ ๐๐๐ง’๐ญ ๐ฐ๐ข๐ง ๐ฐ๐จ๐ซ๐ค?
Since 2017, because of this system of perverse incentives, it is my opinion that we’ve driven almost every compliant company out of the DIB.
Even today, with CMMC looming over us, the companies that are able to bid low are ๐ด๐ต๐ช๐ญ๐ญ ๐ธ๐ช๐ฏ๐ฏ๐ช๐ฏ๐จ ๐ต๐ฉ๐ฆ ๐ธ๐ฐ๐ณ๐ฌ! I can’t even fault contractors for dragging their feet on cybersecurity. If they didn’t have that attitude, they would be GONE.
I have to give major respect to Katie Arrington, Stacy Bostjanick, and DoD A&S leader Ellen Lord for identifying the solution to this problem: mandatory verification of compliance as a prerequisite for contract award.
CMMC is the solution that will fix the perverse system which makes compliant defense contractors too expensive to win the work. We should be rewarding them, not driving them to bankruptcy.
In the meantime, is there any way to protest a contract award when you know your competitor isn’t performing cybersecurity? It is a fairly simple task for a systems administrator to look up DNS records for a company to see if they are using FedRAMP cloud providers. Could that be a strategy? Has anyone heard of this working?