WASHINGTON — The Department of Defense is actively working on plans to build cybersecurity requirements for the defense industrial base into defense contracts as part of its Cyber Maturity Model Certification, or CMMC, program. The first contracts with these built-in requirements are expected sometime in 2025.
But for small businesses that may not have the resources to meet stringent cybersecurity requirements, the Army is planning to launch a pilot program called Next Generation Commercial Operations in Protected Enclaves, or NCODE, said Army Undersecretary Gabe Camarillo. during a discussion Tuesday at the 2024 Association of the United States Army Annual Meeting and Exposition in Washington.
“This essentially provides a secure cyber enclave in a safe environment for small businesses to participate in where they can collaborate, share information, [and] more importantly, to do their job that they need to, which would otherwise present a threat vector to actors that we know are very active in the cybersecurity space,” Camarillo said. “What’s great about this IS [that] is CMMC compliant, so all departmental requirements will be met by operating in this environment.”
Camarillo said many of the small businesses the Army worked with last year were at least partially at risk to cybersecurity threat vectors.
“Depending on how they are capitalized and how many resources they have, their ability to overcome [those risks]despite our efforts across the department, it can be very, very challenging,” he said. “So we knew we had to do something.”
The Army is setting aside about $26 million in both fiscal year 2025 and fiscal year 2026 for the NCODE pilot program, Camarillo said.
“[It] it’s going to be an initial effort in creating a kind of a classified safe enclave where there’s going to be collaboration tools, there’s going to be a workspace where these companies can do what they need to do and also start doing some software development efforts for those in that type of business,” he said.
How small businesses can apply to participate in NCODE and how many will be able to participate are details still being worked out within the office of the Assistant Secretary of the Army for Acquisition, Logistics and Technology, Camarillo said.
“I think we’re going to learn a lot in terms of how it’s used and how effective it is with the initial type of tranche of small businesses that we bring into it,” he said. “And I think the goal is to learn from that and continue to evolve the program to make it even better.”
DOD programs
Helping small businesses find success working with the Defense Department is one of the roles of the DOD Office of Small Business Programs, and the department has been successful in that effort, said program director Farooq Mitha.
One example of this is DOD’s APEX Accelerator program, which aims to teach small businesses what they need to do business with the government.
“Our APEX accelerator program, which used to be with [Defense Logistics Agency,] and we got it about two years ago now, [includes] Our 97 centers across the country that help companies learn how to do business with DOD,” Mitha said.
APEX accelerators, Mitha said, are now focused on helping small businesses comply with things like CMMC and also helping them find more information on programs and opportunities that exist within DOD.
DOD’s Mentor-Protector program has been strengthened in recent years, Mitha said. The program is the oldest continuously operating federal mentor-advocate program. Under the program, small businesses partner with other companies to help them learn to expand their footprint within the defense industrial base.
As for the Mentor-Protégé Program, he said, DOD has been working to return funding for the program to the president’s budget and is also working with Congress in fiscal year 2023 to make the program permanent. There are also changes to the program to improve its performance, he said. For example, the revenue requirement for companies that want to serve as mentors changed from $100 million to $25 million.
“We strongly believe that sometimes, or often, small and medium-sized businesses can guide small businesses better than a large company,” he said.
While firms serving as mentors within the Mentor-Protégé Program were already eligible to receive cost reimbursement for their role, a new pilot program, Mitha said, offers up to 25% reimbursement to protégé firms for engineering, software development or production customization.
Mitha also said that as part of the Mentor-Protégé Program, the timeline for developing partnership contracts has been accelerated.
“Contracting timelines used to be 12 to 18 months,” he said. “We have now created a new centralized contracting mechanism where we are now delivering better mentor/protégé deals in 60 days or less.”