Army announces efforts to help small businesses meet cybersecurity requirements | Article

WASHINGTON — The Defense Department is actively working on plans to build cybersecurity requirements for the defense industrial base into defense contracts as part of its Cybersecurity Maturity Model Certification, or CMMC, program. The first contracts with these requirements incorporated are expected sometime in 2025.

But for small businesses that may not have the resources to meet stringent cybersecurity requirements on their own, the Army plans to launch a pilot program called Next Generation Commercial Operations in Defended Enclaves, or NCODE, Army Undersecretary Gabe Camarillo said. during a panel discussion Tuesday at the 2024 Association of the United States Army Annual Meeting and Exposition in Washington.

“This essentially provides a secure cyber enclave in a safe environment for small businesses to participate in, where they can collaborate, share information, and most importantly, do their own work that they need, which would otherwise be a threat vector for actors. that we know are very active in the cyber security space,” Camarillo said. “What’s great is (that) it’s CMMC compliant, so all of the department’s requirements would be met by operating in this environment.”

Camarillo said many of the small businesses the military worked with last year were at least partially at risk for cybersecurity threat vectors.

“Depending on how they’re leveraged and how many resources they have, their ability to overcome (those risks), despite our best efforts within the department, can be very, very challenging,” he said. “So we knew we had to do something.”

The Army is allocating about $26 million in both fiscal year 2025 and fiscal year 2026 for the NCODE pilot program, Camarillo said.

“(It will be) an initial foray into creating a sort of secure classified enclave where there will be collaboration tools, there will be a workspace where these companies can do what they need to do and also start doing some software development efforts for those who are in this type of business,” he said.

How small businesses can apply to participate in NCODE and how many will be able to participate are details being worked out in the office of the Assistant Secretary of the Army for Acquisition, Logistics and Technology, Camarillo said.

“I think we’re going to learn a lot in terms of using it and how effective it is with the initial type of small business tranche that we bring into it,” he said. “And I think the goal is to learn from that and continue to evolve the program to make it even better.”

DOD programs

Helping small businesses find success in working with the Department of Defense is one of the roles of DOD’s Office of Small Business Programs, and the department has been successful in that effort, said program director Farooq Mitha.

One example of this is DOD’s APEX Accelerator program, which aims to teach small businesses what it takes to do business with the government.

“Our APEX accelerator program, which was with the (Defense Logistics Agency) and we took over about two years ago, (includes) the 97 centers around the country that help companies learn how to do business with DOD.” , Mitha said.

The APEX accelerators, Mitha said, are now focused on helping small businesses comply with things like CMMC and also helping them find more information about programs and opportunities that exist within the DOD.

DOD’s Mentor-Protégé program has been strengthened in recent years, Mitha said. The program is the oldest continuously operating federal mentor protection program. Under the program, small businesses are partnered with other companies to help them learn how to expand their footprint in the defense industrial base.

Regarding the Mentor-Protégé Program, he said, DOD worked to get funding for the program back in the president’s budget and also worked with Congress in fiscal year 2023 to make the program permanent. There are also changes to the program to improve its performance, he said. For example, the revenue requirements for companies wishing to serve as mentors have changed from $100 million to $25 million.

“We strongly believe that sometimes, or often, SMBs can mentor small businesses better than a large company,” he said.

While firms serving as mentors under the Mentor-Protégé Program were already eligible to receive cost reimbursement for their role, a new pilot program, Mitha said, offers up to 25 percent reimbursement to protégé firms for engineering, software development or production customization.

Mitha also said that as part of the Mentor-Protégé Program, the deadline for the development of partnership contracts was accelerated.

“Typically, contracting times were 12 to 18 months,” he said. “We have now established a new centralized contracting mechanism where we are now awarding better mentor/protégé agreements in 60 days or less.”