GIVEN THE SEC’S 2022 PROPOSED CYBER RULE AMENDMENTS,IS THE DOD’S CMMC FRAMEWORK A VIABLE CYBER FRAMEWORK?

This essay aims to discuss the Security and Exchange Commission (SEC) proposed cyber rule changes, and their effect on cyber security risk management frameworks, particularly the Cyber security Maturity Model Certification (CMMC) framework, currently advocated by the Department of Defence. The issues surrounding the SEC proposed rule changes are discussed, pointing out their benefits and limitations. The CMMC framework is then described, observing that for CMMC 2.0 Level 2 and Level 3 compliance, an entity must be NIST SP 800-171 and NIST SP 800-172 compliant, respectively. Three other frameworks are discussed, including the NIST Cyber security Framework, the ISO/IEC 27001 framework, and the HITRUST Cyber Security Framework and its current variations. The article points out that only HITRUST i1 and HITRUST r2 are likely CMMC 2.0 compliant. The paper concludes by noting that when a firm is faced with the SEC proposed cyber rule changes and CMMC 2.0, how a company behaves is dependent on its current cyber security situation and whether it wishes to become or remain a defence contractor or sub-contractor. Even so, by adhering to some cyber security framework, a firm is likely evolving into an organization that treats cyber security as a normal business operation, much like accounting, finance, or marketing.