[House Hearing, 117 Congress] [From the U.S. Government Publishing Office] CMMC IMPLEMENTATION: WHAT IT MEANS FOR SMALL BUSINESSES ======================================================================= HEARING BEFORE THE SUBCOMMITTEE ON OVERSIGHT, INVESTIGATIONS, AND REGULATIONS OF THE COMMITTEE ON SMALL BUSINESS UNITED STATES HOUSE OF REPRESENTATIVES ONE HUNDRED SEVENTEENTH CONGRESS FIRST SESSION __________ HEARING HELD JUNE 24, 2021 __________ [GRAPHICS NOT AVAILABLE IN TIFF FORMAT] Small Business Committee Document Number 117-021 Available via the GPO Website: www.govinfo.gov __________ U.S. GOVERNMENT PUBLISHING OFFICE 44-926 WASHINGTON : 2021 ----------------------------------------------------------------------------------- HOUSE COMMITTEE ON SMALL BUSINESS NYDIA VELAZQUEZ, New York, Chairwoman JARED GOLDEN, Maine JASON CROW, Colorado SHARICE DAVIDS, Kansas KWEISI MFUME, Maryland DEAN PHILLIPS, Minnesota MARIE NEWMAN, Illinois CAROLYN BOURDEAUX, Georgia TROY CARTER, Louisiana JUDY CHU, California DWIGHT EVANS, Pennsylvania ANTONIO DELGADO, New York CHRISSY HOULAHAN, Pennsylvania ANDY KIM, New Jersey ANGIE CRAIG, Minnesota BLAINE LUETKEMEYER, Missouri, Ranking Member ROGER WILLIAMS, Texas JIM HAGEDORN, Minnesota PETE STAUBER, Minnesota DAN MEUSER, Pennsylvania CLAUDIA TENNEY, New York ANDREW GARBARINO, New York YOUNG KIM, California BETH VAN DUYNE, Texas BYRON DONALDS, Florida MARIA SALAZAR, Florida SCOTT FITZGERALD, Wisconsin Melissa Jung, Majority Staff Director Ellen Harrington, Majority Deputy Staff Director David Planning, Staff Director C O N T E N T S OPENING STATEMENTS Page Hon. Dean Phillips............................................... 1 Hon. Beth Van Duyne.............................................. 3 WITNESSES Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC, Washington, DC............................................................. 5 Mr. Scott Singer, President, CyberNINES, Madison, WI............. 7 Ms. Tina Wilson, Chief Executive Officer, T47 International, Inc., Upper Marlboro, MD....................................... 8 Mr. Michael Dunbar, President, Ryzhka International LLC, Pompano Beach, FL, testifying on behalf of the HUBZone Contractors National Council............................................... 10 APPENDIX Prepared Statements: Mr. Jonathan T. Williams, Partner, PilieroMazza PLLC, Washington, DC............................................. 25 Mr. Scott Singer, President, CyberNINES, Madison, WI......... 33 Ms. Tina Wilson, Chief Executive Officer, T47 International, Inc., Upper Marlboro, MD................................... 42 Mr. Michael Dunbar, President, Ryzhka International LLC, Pompano Beach, FL, testifying on behalf of the HUBZone Contractors National Council............................... 44 Questions for the Record: None. Answers for the Record: None. Additional Material for the Record: Ho-Chunk Inc................................................. 51 IPC Report June 2021......................................... 59 National Defense Industry Association (NDIA)................. 74 CMMC IMPLEMENTATION: WHAT IT MEANS FOR SMALL BUSINESSES ---------- THURSDAY, JUNE 24, 2021 House of Representatives, Committee on Small Business, Subcommittee on Oversight, Investigations, and Regulations, Washington, DC. The Subcommittee met, pursuant to call, at 10:01 a.m., in Room 2360, Rayburn House Office Building, Hon. Dean Phillips [chairman of the Subcommittee] presiding. Present: Representatives Phillips, Davids, Evans, Craig, Hagedorn, Meuser, Van Duyne, and Fitzgerald. Chairman PHILLIPS. All right. Good morning, everybody. I call this meeting to order. And without objection, the Chair is authorized to declare a recess at any time. Let me start by saying that the standing House and Committee rules and practice will continue to apply during hybrid proceedings. All members are reminded that they are expected to adhere to these standing rules, including decorum. House regulations require members to be visible through a video connection throughout the proceeding, so please keep your cameras on. And also, please remember to remain muted until you are recognized to minimize background noise. And turn your microphone on when you are recognized, of course. If you have to participate in another proceeding, please exit this one and log in later. In the event a member encounters technical issues that prevent them from being recognized for their questioning, I will move to the next available member of the same party and I will recognize that member at the next appropriate time slot, provided that they have returned to the proceeding. For those members and staff physically present in the Committee room today, we will continue to follow the most recent OAP guidance. Masks are no longer required in our meeting spaces for members and staff who have been fully vaccinated. All members and staff who have not been fully vaccinated are still required to wear masks and socially distance. I do hope that we do all our parts to protect each other and our staff. With that, I will begin with my opening statement. Cyber attacks have the potential to threaten public safety and undermine the American economy and national security. The early months of 2021 have provided harsh reminders of this very fact. Over the past 6 months, hackers and other malicious actors have held an oil pipeline for ransom, breached the Nation's largest transit network, and attacked private companies to obtain sensitive customer data. According to the Council of Economic Advisers, malicious cyber activity has cost the U.S. economy between 57- and $109 billion since 2016. With our society's reliance on technology and digitization growing, there is no doubt that cyber attacks will only become more prevalent moving forward. Recognizing the urgency of cyber threats, the Department of Defense has taken steps to protect sensitive defense information from attacks aimed at over 300,000 companies that compose the Defense Industrial Base, the DIB. One of these efforts has been the creation of the Cybersecurity Maturity Model Certification. The CMMC is a framework that seeks to improve the protection of different types of sensitive, unclassified information through the implementation of a unifying security standard across the DIB. The CMMC framework consists of a tiered system with a series of processes and practices at each level. The program was designed based on numerous cybersecurity standards and frameworks. CMMC relies on third-party certification to assess the relative cybersecurity maturity of DIB companies, thus when the initiative is finally implemented and all contracts and requirements incorporated a specific CMMC level, only those contractors who have achieved the required CMMC level through the certification process will be eligible for an award. The need for cybersecurity is unquestionable. It is vital that companies in the DIB become more resilient and prepared for cyber attacks. With that said, the CMMC Initiative has the potential of driving many small businesses out of the Defense Industrial Base, therefore, we must get this right. To that end, it is important to pay attention to the numerous red flags that small businesses have raised about this initiative. For example, many have a concern about the significant cost associated with CMMC compliance. Guarding against cyber attacks can be cost prohibitive for many small businesses. And firms that seek to abide by CMMC must purchase new hardware and software, replace outdated technical systems, and pay the costs of initial certification and maintenance amongst other expenditures. Small businesses often run on thin margins as we know, and the cost of CMMC has the potential to leave many small firms in the sector without a chance to compete for government contracts. Many small businesses also don't have the capacity to deal with the complexity of the initiative. Employers at small enterprises often wear many hats and have limited regulatory or compliance resources. This means that independent firms will be forced to turn to outside specialists for help to navigate the program. For many small contractors, this will not be feasible. According to Department plans, the DOD will implement the CMMC initiative on select contracts between fiscal year 2021 and 2025. In addition, in March, DOD initiated an internal assessment of CMMC partially guided by an effort to manage cybersecurity costs for small businesses. This is a very timely hearing, as it allows us to take a closer look at the program and its implications for small businesses. There is no doubt that contractors working with the DOD must have adequate systems in place to handle cyber threats. At the same time, we cannot allow the program requirements to drive small businesses out of the defense procurement space. With that, I would like to yield to the Ranking Member, Ms. Van Duyne, for her opening statement. Ms. VAN DUYNE. Thank you, Mr. Chairman. We should have compared notes before we gave our opening statements, because I am going to echo many of the sentiments that you just shared. Just a few short weeks ago, we saw how a malicious ransomware attack perpetuated by foreign actors on the Colonial Pipeline can cause chaos across the entire Eastern Seaboard. And not long after that, another attack shut down one of the leading meat producers in the United States. The potential for profit and opportunity to disrupt U.S. critical infrastructure has invited a number of cyber criminals to target U.S. network vulnerabilities and one of the softest targets to obtain valuable Department of Defense information is through our small contractors. Recognizing the increased vulnerabilities of small contractors, the DOD initiated new cybersecurity assessment framework, called the Cybersecurity Maturity Model Certification, to assess contractor implementation of cybersecurity requirements. While no one disputes the Federal Government's need to address the growing cybersecurity risks facing our Nation, I am deeply concerned that the CMMC has created yet another hurdle to keep small businesses from competing in the defense marketplace, exactly what we just heard from our Chairman. A major concern is the cost of compliance. No matter how you look at it, adding stringent cybersecurity requirements will be a costly endeavor for small businesses that are already recovering from a pandemic. With limited resources compared to the competitors in the defense contracting space, small businesses are understandably wary of deploying that capital without assurance that their investment will return in future work. The Federal Government has already experienced a 38 percent decline in its industrial base for the past decade and measures like this will only exasperate this exodus. Simply put, we need to ensure a competitive contracting environment for small business. This would not only benefit our small employers, but would be a net benefit for our national defense. I also have major concerns with the rollout of the CMMC for a number of reasons. First, the assessments may be inconsistent and unfair because the new process is being handled by many newly trained assessors. There are also many questions outstanding about how subcontractors will be treated under this new framework. And, finally, I am worried that small contractors will be shut out of the conversation entirely, and forced to the end of the line. The fact is that this new process may threaten the livelihood of many small businesses. No assistance, no assessment means no certification, and no certification means no work. Small businesses rightly fear that they won't be given a fair share, left to fend for themselves, as we have too often seen when it comes to sweeping government reforms. Dealing with cyber threats is an extremely nuanced issue that will require continued collaboration, and while the DOD may have good intentions with the CMMC initiative, we must ensure that the voices of small businesses operating in the Defense Industrial Base are heard and have their concerns addressed. I look forward to hearing the testimony of the witnesses today. And I yield back. Chairman PHILLIPS. Thank you, Ms. Van Duyne. The gentlelady yields back. And I will just take a moment to explain how the hearing will proceed. Each witness will have 5 minutes to provide a statement and each Committee member will have 5 minutes for questions. Please ensure that your microphone is on when you begin speaking and that you return to mute when you are finished. With that, I would like to introduce our witnesses. Our first witness is Mr. Jonathan T. Williams, partner with the law firm of PilieroMazza in Washington, D.C. As Chair of their government contracts group, he counsels companies on a variety of Federal acquisition regulation compliance issues. Mr. Williams is also a member of PilieroMazza's cybersecurity and data privacy team. In this role, Jon works with Federal contractors, particularly those who contract with the DOD, on managing cybersecurity and establishing compliant and effective safeguards. We appreciate your expertise on today's topic. Our second witness is Mr. Scott Singer, president of CyberNINES with offices in both Wisconsin and Minnesota. Mr. Singer is a retired U.S. Navy captain bringing over 30 years of military experience in both Active Duty and Reserve roles, along with 26 years of industry experience. His company, CyberNINES, is a service-disabled veteran-owned small business, focused on cybersecurity services and a candidate third-party assessment organization for CMMC. We appreciate you as well, Mr. Singer, for your contributions to today's discussion. Our third witness is Ms. Tina Wilson, founder and Chief Executive Officer of T47 International, located in Upper Marlboro, Maryland. Ms. Wilson is an Air Force veteran, and T47 International is an 8(a) veteran-owned, and women-owned small business, offering a wide range of professional support services to the defense community. We thank you also for sharing your story today. With that, our Ranking Member, Ms. Van Duyne, will introduce Mr. Dunbar. Ms. VAN DUYNE. Okay. Hold on just a minute. Thank you very much. I would like to welcome our final witness, Mr. Michael Dunbar. Mr. Dunbar is the president of Ryzhka International, a service-disabled, veteran-owned small business founded in May of 2011, and a HUBZone certified firm as of February of 2014. They have lubricants and fuel oil to government, commercial, and maritime clients worldwide, and proudly provide 100 percent American-made products. From its initial founding to today, the company has grown from one to six employees and successfully serves clients ranging from the U.S. Army Corps of Engineers, the Department of Veterans Affairs, the U.S. Navy and Coast Guard, the National Oceanic and Atmospheric Administration, various shipyards in many of the dredging community. Ryzhka International has been the proud recipient of several awards. This is the Department of Defense's award for support of the Guard and Reserve. And in addition to its businesses, the company's secondary mission is to provide gainful employment opportunities to qualified individuals from disadvantaged segments of society, such as minorities, women, people with disabilities, and veterans. Chairman PHILLIPS. And we will begin with Mr. Williams--oh, I am sorry. Ms. VAN DUYNE. Sorry. You are good. You are good. The secondary focus is no surprise considering Mr. Dunbar's own military service in the U.S. Navy Nuclear Power program and its status as a service-disabled veteran. After his military service, Mr. Dunbar went on to spend the summer working on the solid rocket boosters for National Aeronautics and Space Administration's space shuttle. Following that summer, he attended the University of Utah, went on to have a successful career as an executive in the biotech industry, and afterwards, started his own company. Mr. Dunbar will be speaking today on behalf of the HUBZone Contractors National Council, which is a nonprofit trade association advocating for policies bringing opportunities to HUBZone certified small businesses and the economically disadvantaged communities in which these companies are based. Mr. Dunbar, thank you for your participation today. We look forward to hearing your testimony. I yield back. Chairman PHILLIPS. Thank you, Ms. Van Duyne. The gentlelady yields back. Sorry, Mr. Dunbar. My bio is about one sentence long, so I am not accustomed to two pages. With that, we are going to recognize Mr. Williams for 5 minutes for your opening statement. Mr. Williams. STATEMENTS OF JONATHAN T. WILLIAMS, PARTNER, PILIEROMAZZA PLLC; SCOTT SINGER, PRESIDENT, CYBERNINES; TINA WILSON, CHIEF EXECUTIVE OFFICER, T47 INTERNATIONAL, INC.; AND MICHAEL DUNBAR, PRESIDENT, RYZHKA INTERNATIONAL LLC, TESTIFYING ON BEHALF OF THE HUBZONE CONTRACTORS NATIONAL COUNCIL STATEMENT OF JONATHAN T. WILLIAMS Mr. WILLIAMS. Good morning, Chairman Phillips, and other distinguished members of the Subcommittee. My name is Jonathan Williams, and I am a partner with the law firm PilieroMazza, which represents government contractors. Many of our clients are small businesses that work with the Department of Defense as prime contractors and subcontractors. It is an honor to participate in this hearing on DOD Cybersecurity Maturity Model Certification to share my perspective on the CMMC Initiative. DOD's focus on cybersecurity has been steadily building for many years, with measures ranging from implementation of new regulations and contract clauses to the elevation of cybersecurity as the fourth pillar of DOD's acquisition planning. DOD has left no doubt about the importance it has placed on enhancing cybersecurity for the Defense Industrial Base, and with good reason, as recent events like the pipeline shutdown demonstrate. CMMC marks a significant change in DOD's evolving approach to cybersecurity. With CMMC, contractors will no longer be allowed to use the honor system by self-certifying their cybersecurity. Instead, contractors will have to apply for certification from a third-party assessor. These so-called C3PAOs will evaluate the contractor's cybersecurity against established benchmarks and decide whether to certify the contractor in one of five levels. The lowest level of CMMC is level one, which requires the fewest and most basic cybersecurity measures. The level one requirements are things all businesses should be doing, like spam filters and antivirus software. The cost and complexity of the requirements increases significantly at the higher levels of CMMC. DOD has said it intends to start requiring CMMC on a few contracts this fiscal year with that number increasing steadily over the next several years until fiscal year 2026, when all DOD contractors will be required to have CMMC. However, the implementation schedule has slipped a few times already and remains in flux. Approximately 2 years into the CMMC Initiative, many practical questions that small businesses are asking remains unanswered. These are basic questions like, when will I need CMMC? How much will it cost? What level do I need? And how do I get it? Many small businesses will not be able to adequately prepare for CMMC until these questions are answered. For example, DOD estimates that most small businesses will only need level one; however, that is not guaranteed. DOD agencies are more likely to require at least level three for many of their contracts, and prime contractors may flow down the same level to their subcontractors. Given the substantial difference in cost and technological know-how between level one and level three, many small businesses will be unable to compete if more than a level one is required. From my discussions with the small businesses we represent, I have several suggestions for how to make the CMMC Initiative more manageable for small businesses, including the SBA and DOD mentor-protege programs should be utilized to ensure that mentors provide small businesses with resources and guidance to obtain CMMC. Joint ventures, a popular tool for small businesses to pursue government work, should not be required to have CMMC when the member companies are certified. C3PAOs should be required to fast-track CMMC applications when the applicant is a small business that is in line for award of a contract. DOD contract clauses should prohibit prime contractors from imposing a more stringent level of CMMC on a subcontractor than is necessary based on the scope of the subcontract. And finally, DOD and prime contractors should explore alternative ways to give small businesses access to sensitive information that will enable more small businesses to participate on DOD contracts with a level one certification. In closing, I believe the CMMC Initiative appropriately aims to improve our Nation's cybersecurity posture. I do not think small businesses would debate the importance of cybersecurity, or that doing business with the Federal Government is a privilege that requires investments in compliance and infrastructure. At the same time, the worthy goals of the CMMC Initiative must be calibrated to avoid creating an unnecessarily high barrier to entry for small businesses, which are the engine of our economy and critical partners with the Federal Government for innovation and provision of many necessary services and supplies. This concludes my testimony. Thank you, again, for the opportunity to appear before you today. Chairman PHILLIPS. Thank you, Mr. Williams. A perfect 5 minutes at that. We appreciate it. Now we recognize Mr. Singer for 5 minutes. STATEMENT OF SCOTT SINGER Mr. SINGER. Thank you, Representative Phillips, Ranking Member Representative Van Duyne, and members of the Subcommittee, for inviting me to testify this morning. I look forward to providing information that will help ensure we have a secure Defense Industrial Base and find cost-effective solutions to allow small business to fully comply with CMMC. My name is Scott Singer, and I am the owner and president of CyberNINES. CyberNINES was founded only in June of 2020; however, thanks to the interim final rule released on November 30, 2020, we have been really busy. And I have done assessments in the districts of some of the members of this Subcommittee. Small businesses do not have purchasing or IT departments. They do not have compliance or regulatory departments. We need to make this easier for them. Primes, certified third-party assessors, registered provider organizations, all can assist these small businesses get compliant and reduce the complexity for them. Having a program where the primes take a strong guiding hand of their supply chain is critical to maintaining these small businesses as DOD suppliers. Of the last 33 basic assessments CyberNINES has conducted, the average compliance score was minus 105. Plus 110 is perfect. We have found that on average, they are about only 34 percent of the way toward meeting all the risk controls. Cost models put forth by the government assume that companies are much further along on this journey, and they actually should be by this point. Assuming full compliance to NIST, the DOD has put out that this will cost $26,000 to complete the 20 additional practices followed by an additional $29,000 to be assessed by a C3PAO. As discussed above, small businesses that we have assessed are only partway there, and we have come up with costs more to the tune of about $130,000 for these businesses to be able to be compliant. Last week, I conducted a basic assessment of a small manufacturer in Minnesota. They had only six employees, one small manufacturing space with three machines, and they do excellent innovative work. I spent a good majority of my time doing the assessment actually from the owner's house. This year, he expects to make 875K in revenue. My estimate is that if he wants to stay a DOD contractor, he will have to spend 10 percent of his revenue over the next 3 years alone on getting compliant. Small businesses have been directed to add their allowable costs to get compliant to their indirect rates. Most don't do cost reimbursement contracting for DOD. Moreover, market factors around competition for orders will require them to compete and lower prices. Established contractors will be more likely to be able to provide a lower bid and win the order from the prime. There should be a process separate from the competitive marketplace to allow small businesses to get paid for the reasonable, necessary, and allowable cyber compliance expenses. Companies further ahead should not be penalized and be able to recoup their past expenses, too. In addition to the difficulty small businesses have funding this effort, there are bottlenecks for getting enough assessors. In doing the math, I just don't see how--and this is my opinion--we can get enough C3PAOs and assessors through the process to assess 300,000 DIB companies by October 1, 2025. I saw one estimate that we would need over 8,000 assessment team members working full-time from today on to make this happen. To get more C3PAOs through the process, I recommend there be a relaxation for the initial C3PAOs. Assess candidate C3PAOs to maturity level one or two now, and then require level three in the future. The requirement for tier three background investigations for assessment and support staff creates another bottleneck. I would recommend allowing an interim clearance process for that. In conclusion, the majority of the 300,000 contractors in the DIB are small businesses. Without monetary support and clear regulatory guidance, the DOD will lose small businesses as they will look to find business in the commercial sector. A balance must be struck between risk and cost. Too much cost, we lose suppliers; too much risk, and we hurt our national security. Thank you for allowing me to testify, and I look forward to your questions. Chairman PHILLIPS. Thank you, Mr. Singer. And now we recognize Ms. Wilson for 5 minutes. STATEMENT OF TINA WILSON Ms. WILSON. Chairman Phillips, Ranking Member Van Duyne, and members of the Subcommittee, thank you for the invitation to testify today. I am Tina Wilson, CEO, T47 International, and I am honored to have the opportunity to provide some insight regarding the implementation of DOD CMMC Initiative. As a business owner with over 260 employees located in 28 States and overseas, T47 provides a variety of staffing services from budget and finance, janitorial, inventory management, aircraft tools, maintenance to mail room, and nonclinical medical and dental case managers. The diversity of services offered puts me in a unique position to provide a different perspective regarding this subject. As CMMC standards continue to be developed and incorporated into contract agreements and modifications, it is essential that the Small Business Committee be aware of the policy impact. If the CMMC standards are not clearly communicated and monitored for fraud, the financial ramifications to the over 300,000 Defense Industrial Base of contractors, and specifically to the small business community, could be devastating. Based on this statement, I will cover three main subject areas of concern and offer recommendations. Cost to secure CMMC. As of today there is no set cost to obtain CMMC. The CMMC accreditation body has stated that the marketplace will need to define the cost, which leaves it wide- open for interpretation what this cost will be. Whether it is a tiered cost based on the size of the business, or a set cost regardless of the size, there will be initial and sustained cost that will impact small businesses' ability to secure the certification. A similar certification offered by the International Organization for Standardization, ISO, is standard 27,000, which is information technology and focuses on security for any kind of digital information. This certification costs between 28- to $35,000 to obtain, and takes approximately 6 to 8 months to implement. This is a tremendous cost burden to add to a very tight budget for most small businesses. Cost of not having CMMC. While unknown as of today, what has been communicated to the entire Defense Industrial Base is that if you don't have CMMC at the basic level, you will not be eligible for a Federal contract. Many small businesses may not even be aware this new requirement and failure to obtain certification means ending contract work as a service provider to the DOD. Additionally, as the prime contractor, it will be our responsibility to flow down the requirements to our subcontractors. If the subcontractor does not have certification, we would be required to end subcontract agreements to remain compliant with the DOD CMMC standards. Audit imposters. I raise this subject as an awareness to inform the Subcommittee. When the DOD presented the CMMC as the new way of life for all businesses within the Defense Industrial Base in the summer of 2019, many business owners asked a lot of questions of why? Who will conduct the implementation and audit? How much? When will it happen? Implications, or if you do not have it, and many more questions. Before the CMMC accreditation body was formed in the latter part of 2019, audit imposters with no training and not accredited, start advertising that they will certify your company as cyber compliant for thousands of dollars to get a company ready. For many small businesses that are just now hearing about this standard, may in a moment of panic and fear of losing their government contract, may fall prey to an audit imposter. As I close, I recommend that the Subcommittee members closely monitor this very important implementation of CMMC Initiative. While I know there are so many other issues to focus on, CMMC has ramifications that reach far beyond what we can realize at this moment. It is important that, one, cost is articulated clearly to reduce price gauging and to allow the small businesses to plan; number two, a balanced cost approach that does not reduce small business participation in the Federal marketplace; number three, DOD continues to work closely with various advocacy groups to ensure that the Defense Industrial Base contractors, known at the Office of Small Business, is aware of this implication to this new initiative; and four, DOD and the Office of Small Business start as soon as possible to put various roadblocks in place to reduce the number of audit imposters. Thank you for your time in addressing this very important subject that impacts thousands of small businesses that do business with the Department of Defense. Chairman PHILLIPS. Thank you, Ms. Wilson. And now I recognize Mr. Dunbar for 5 minutes. STATEMENT OF MICHAEL DUNBAR Mr. DUNBAR. Chair Phillips, Ranking Member Van Duyne, and members of the Subcommittee, thank you for the opportunity to testify before you today. My name is Michael Dunbar, and I am the president of Ryzhka International, located in Pompano Beach, Florida. Ryzhka International provides lubricants, fuel oil in bulk quantities, package quantities to the Federal Government, commercial maritime industries. I am a proud service-disabled, veteran-owned small business, as well as a HUBZone certified small business. I am testifying today on behalf of the HUBZone Contractors National Council, a nonprofit trade association providing information and support for companies and professionals interested in the Small Business Administration's HUBZone program. We would like to thank the Committee for its commitment to small business and for advancing policies that support small businesses doing business with the Federal Government. In a recent hearing, Deputy Assistant Secretary of Defense of Industrial Policy, Jesse Salazar, said it best: The Department's approach to cybersecurity must balance the need for accountability with the recognition of the challenges facing small businesses. Small businesses understand the importance of cybersecurity, and the very real threats facing their companies. We are not looking for a way to opt out or ignore this problem. We want to secure our companies. According to the DOD's contracting data, 74 percent of the Defense Industrial Base are small businesses. These contractors are critical to the government, and are not a group that can be ignored. The Federal Government has long identified the need to safeguard sensitive information and understands that cybersecurity is dynamic issue. Small businesses, however, are experts on the goods and services they provide. We do our best to focus on supplying a product, making a profit, and retaining employees. Most small businesses are not IT professionals. We are not cybersecurity specialists either. I am--right here is the assessment guide. This is for cybersecurity CMMC model level three. It is full of stuff I have no idea and don't understand. I have to hire somebody to figure this out. The initial cost for me to start my business was less than $1,000. The cost to start a new government-focused business with this, 10,000, 100,000; we really don't know. Access to capital can be a very challenging issue for small businesses, and we have to use significant capital now to become CMMC certified. The segments hurt most are the segments that can least afford it. The Federal Government already has challenges meeting those goals. If we reduce the number of companies that qualify, you also reduce opportunity for people to start up new businesses in those sectors. The council makes the following recommendations to improve the rollout of CMMC, and maintain a strong industrial base. Increased cost transparency and put guardrails on rising compliance costs for small business. One of the biggest frustrations for small business throughout the rollout has been cost transparency. Some small businesses have estimated costs in excess of $100,000 to prepare for level three certification. That doesn't include the assessment costs. I have heard of assessment costs already estimated at above $150,000 for a 50- person company. Establish clear communication on CMMC efforts. A lack of transparency, clear, consistent communication by the DOD, and the rollout of CMMC and its implementation by the CMMC accreditation body has been concerning. The council suggests putting together a more clear, consistent delivery of information through a central government platform or website. Streamline new and existing standards for contractors. The Federal Government lacks unified cybersecurity standards across all agencies. The council encourages the DOD to work closely with industry, particularly small businesses, to streamline these requirements allowing companies to have a plan of action and milestones after a CMMC assessment would help these burdens. Create a system for oversight and equitable rollout. Many small businesses worry that they will be put at the back of the line and face massive delays as companies serve the subcontractors, and equitable rollout is important to these companies as well. In conclusion, the Federal Government has a long and complex history of governing cybersecurity regulations and compliance with its contractors. A streamlined approach needs to be taken for contractors to navigate all of these standards and system successfully. Thank you for the opportunity to testify today, and I look forward to your questions. Chairman PHILLIPS. Thank you, Mr. Dunbar, and to all of our witnesses for being with us today and we appreciate your testimony on the CMMC Initiative. I will begin the hearing now by recognizing myself for 5 minutes. I will start with Mr. Williams. I think we all understand the importance of cybersecurity, and ensuring that the most vulnerable small businesses in the DIB supply chain are protected. However, it is clear that the cost of CMMC could be terribly burdensome for small businesses. So how should we be looking at this? How can we strike the right balance between enhancing cybersecurity, and ensuring that small businesses can participate in DOD acquisitions? Mr. WILLIAMS. Yes. Excellent question. Thank you. I think one of my top suggestions there is to try to make good on DOD's estimate that most small businesses will only need level one. As I said in my testimony, that is not guaranteed, but if we can keep as many small businesses as possible at level one, that will strike the right balance between ensuring that these small businesses have at least the basic cybersecurity protections in place, but will allow them to avoid, as Mr. Dunbar said, the significant additional costs when you go from a level one to a level three. And I think managing the level one versus level three distinction is probably one of the most critical ways to keep the cost down for small businesses. That could be done through flow-down protections. Make sure that primes are not flowing down higher than level one if their subcontractors only need level one. And I would like to see more flexible approaches where the small businesses don't need to take the controlled unclassified information into their own network, because that is what then causes the jump from level one to level three. Let's look at ways that either the DOD and their own systems, or the prime contractors and their own systems, can maintain this information, and let's maybe be more creative and flexible in how we allow small businesses to participate on those programs without having to take that information into their network, and then cause them to have to go up to a level three. Chairman PHILLIPS. Appreciate that. Are there any funding streams of which you are aware that can help small businesses with the costs of CMMC? And if there is anything that Congress, DOD, or even SBA could do to help in that regard, no matter how significant the expenses might be? Mr. WILLIAMS. I am not aware of specifically targeted funding stream at CMMC. I think it would be a fantastic idea if there was the wherewithal for a grant program for small businesses to help them on their way with the upfront investments needed for CMMC. The larger small businesses will be able to make that investment and get it on the back end when they are paid on their contracts with the government, but for the smaller firms, even the several thousand dollars of the investment needed for a level one might be too difficult to make upfront. And I think the existing mentor-protege programs, as I mentioned, those are fantastic programs. They work very well in many respects at the SBA and DOD for small businesses and large businesses. There are a lot of incentives that large business mentors get from participating in those programs. We could be clearer, more well-defined that mentors, when they are permitted to access those programs, have to ensure that one of the things they are doing for their proteges is to provide financial resources and technical assistance to ensure their proteges are ready for CMMC. Chairman PHILLIPS. Thank you very much. Ms. Wilson, I would love to hear from you about your experience. How were you made aware of CMMC? How difficult is it for you and T47 to understand, and do you envision having to engage a consultant or specialist to help you navigate it? Ms. WILSON. Sure. Thank you for the question. I learned about CMMC when attending a DISA Industry Day in 2019 up in Baltimore. I understand completely how it works and, you know, from a broader perspective, but, you know, protecting supply chain, intelligence, assets, IT infrastructure and, you know, things that matter to protect in our Nation. And for T47, the critical part is, we have to secure a specialist, which I have already engaged, because it is very complex. And for someone that is non-IT like myself--I am a business owner. I know how to go get contracts and build a company, but to build an IT infrastructure that impacts a lot of employees and be able to maintain it and go into other secured areas, it is a challenge. So to actually have an expert to help us is going to be critical, and I have engaged in that process already. Chairman PHILLIPS. Thank you very much. My time is expired, and now I recognize the Ranking Member, Ms. Van Duyne, for 5 minutes. Ms. VAN DUYNE. Thank you very much. Mr. Dunbar, okay, hold that up one more time. You need two hands. That is--I mean, I completely understand your frustration right now. Do you believe that the CMMC duplicates any of the multiple standards in cybersecurity programs that currently exist? Do you find that there is a bunch of stuff that is already existing right now that is in that book that you are going to have to do more of? And is there a way to further streamline these disparate processes? Mr. DUNBAR. Thank you very much for the question here. From what I understand--and I am not a technical expert, so I will answer from a layman's perspective--CMMC added, I believe, 20 additional items to NIST 800-171, which is currently the law of the land and what exists today. So what is being projected to be our new standard is built on an existing standard, and part of me questions why we had to go so much further. The reasoning behind putting CMMC in place, part of it was because we were doing self-assessments before for companies instead of having a third-party assessment. Why could they not institute some part of third-party assessment to an existing standard? Why create a whole new standard that people have to learn and understand to begin with? And I didn't have to deal with the first standard because most of my business is what they call is called COTS, which is Commerical-Off-The-Shelf products; however, fuel recently, as we just saw with Colonial Pipeline, has become a very critical item. Is supplying fuel by truck, by whatever method all of a sudden going to become a CMMC level four like the infrastructure piece of it might potentially need to be? That is going to impact a significant number of small businesses like mine. So by adding these additional items, we ask our question as to why, and how do we streamline this? I have in place security right now that covers 77 of the NIST items--covers 77 of the CMMC items, but covers 90 percent of the risk. So is that additional cost-benefit, and we are talking 80 to $100,000 of additional cost to get that other 10 percent realistic for small business? Ms. VAN DUYNE. I am concerned that the critical information about CMMC is being conveyed in a conflicting and potentially informal manner. What are small businesses currently going to seek information or guidance on CMMC? Where are you going to find more information? And then, what would be the ideal method or platform of communication from the DOD to the contracting community? How can we make it easier? Mr. DUNBAR. The main place that we have been receiving information tends to be LinkedIn. We have had members of DOD communicating directly through LinkedIn, members of the CMMC board communicating through LinkedIn. That tends to be the largest location or community of folks getting information on this program. We get very little from DOD directly. They have had some town halls that they call it. You don't really get much notice, if any. Just the other day was mentioned a project spectrum, I believe it is called, that I had never heard of, that was put in place, it looks like some time in 2020. Most small businesses are unaware of this as well, and this is supposed to help us somehow, it is a DOD program, but we are not even aware of it. Ms. VAN DUYNE. Your being sent to a website is probably not going to help you? Mr. DUNBAR. Correct. And that is just--there is no consistent method or message coming out from DOD on where to get things. Even if you go to the CMMC-AB frequently-asked- questions page, sometimes they say Oh, that is a DOD responsibility, and that has been a lot of the kickback is pointing fingers between the CMMC-AB and DOD saying, Well, they are responsible for X; they are responsible for Y. Ms. VAN DUYNE. Specifically for the small business community, I didn't mean to cut you off, if you had anything else to add. Mr. DUNBAR. No, ma'am. Ms. VAN DUYNE. Specifically for the small business community, and I hate to add another agency in here, but do you see a role that SBA could possibly play in helping to be an intermediary between the three? Mr. DUNBAR. I definitely--there should be a role for the SBA in here. I don't feel that the SBA has been able to be involved. I feel that the DOD has sidelined them, at least in my opinion, in the same manner that I think a lot of small businesses have been ignored when we have raised questions or raised issues. And that has basically been kept to a very small group of people that are running all of this, and then we get told later on, Here is what is happening. Ms. VAN DUYNE. Thank you very much. I yield back. Chairman PHILLIPS. The gentlelady's time is expired. And now I recognize the gentleman from Pennsylvania, Mr. Evans, for 5 minutes. Mr. EVANS. Thank you, Mr. Chairman. I would like to ask a question to Ms. Wilson. Small businesses are frequently targeted by cyber criminals. What would the ideal situation be for you in terms of the Department of Defense ensuring that cybersecurity taken care of its small business base? Ms. WILSON. Thank you so much, sir. I think one simple solution to offer, and it could be reasonable cost and possibly free. It is the offer of maybe cyber tools that are already approved by DOD to the small business community as a first line of defense. It could be offered up from the CMMC level one up to possibly level two. And then, at least this way, DOD has a level of comfort to say, Okay, at least we have some tool out there now, it is up to the marketplace, the small business community to go out and secure additional certification, if necessary, to ensure that, you know, at least we are taken care of, and that shows an effort that the DOD cares. That is a critical part. We just need to know that DOD is here to help you. Mr. EVANS. I would like to follow up. For many small business, cybersecurity certification is just one of the many requirements of certification they need to comply with as part of being a defense contract. Can you mention just a few of the other certifications you have to comply with, and how does the cybersecurity certification compare to other certification in terms of its levels of burdens? Ms. WILSON. Sure, sir. So for T47, we have actually invested in securing the ISO certifications, three certifications. We are doing that currently. That is a very costly investment. We will also have the SBA 8(a) certification that is due annually. And because of our size now, we now must incur additional cost for audits that are necessary to keep the certification. We have the woman-owned small business certification, and then as a clear facility, we have the defense counterintelligence security certifications as well to keep our clearance. So, in comparison to all those other certifications was just a small list for us. To be perfectly clear and frank with you, the CMMC has been the most challenging, because it is just a lack of not understanding exactly what is needed, and it is a cost that is involved. There is no transparent cost set aside for, like, small business mid or large. And I know this is a new initiative because any time you roll out a new policy, there is always going to be bumps in the road, but at the same token, there needs to be more of a clear communication from DOD, and those that are managing this process on what it is going to take for small businesses, or all businesses to have the certifications necessary. And that is going to take a concerted effort for everyone to understand. CMMC, to be quite honest with you, it is new, but it is a challenge. And it must be worked out pretty quick because you are going to start rolling these things out into contracts, and the fear could be real once it starts happening. Mr. EVANS. I thank you. And I yield back the balance of my time. Thank you, Mr. Chairman. Chairman PHILLIPS. The gentleman yields back. And now I recognize the Ranking Member of the Subcommittee for Underserved, Agricultural, and Rural Business Development, Mr. Hagedorn of Minnesota for 5 minutes. Mr. HAGEDORN. Mr. Chairman, thank you for that, Ranking Member Van Duyne. It is good to be with you today. Thanks to the witnesses. This seems to be one of these issues, and even the big agencies the Federal Government want to impose a lot of things on small businesses that they themselves don't handle appropriately. It doesn't take--you don't have to think too long and hard to realize that the DOD has lost technology outright, giving it away in some cases, our Federal Government, to China. Economic technology, of course, gets lost a lot by big companies. OPM went and took 25 million records of Federal employees. I was one of those folks that they stole from during the Obama administration, and now they come along and say, Well, if you want to do business with us, you have to go through a bunch of gyrations, spend a bunch of money, and some of it, it seems, could be reasonable. You look at recently, we had some issues with, obviously-- and these things are very important. We had a big meat packing company that does 25 percent of the beef in the United States; have a pork manufacturing plant in Worthington, Minnesota, where I represent, they went down and you see how critical things can be. We can lose our food supply and everything else in the blink of an eye, but Mr. Dunbar, I think--wouldn't it make more sense if the Federal Government just imposed some reasonable standard and said if you want to do business with us, you got to try to do everything possible in order to make sure there is security here, and that you protect these digital ways that you do business? I mean, rather than have you go through all these hoops. I mean, you say it costs up to $100,000, it doesn't seem reasonable to me. Mr. DUNBAR. Thank you, sir, for the question. Yes, I agree. I think the keyword there is the definition of reasonable. I believe the DOD believes that their numbers and that their requirements are reasonable. Small businesses would probably disagree with that when you have a company like mine of six people that has to spend $100,000 to comply with something. There are, as I mentioned, standards out there currently that are being used every day. I mean, right now, a small business--you walk into a small business and we hear advertisements on TV and such saying, We have got your security, Have your internet service through us, we got you covered. Well, that is what a small business thinks. Okay. They got our security for us. No problem. Then we see something like this and say, Well, we really don't have security, do we? We need something in between those two items. My security that I currently have in place is, as I mentioned, covers 77 of the items that are being requested in 90 percent of the problems, and it is costing me about $15,000 a year to $20,000 a year to do that. I could get away with a little bit less, but I have insurance and other things on it that get tossed into there to cover in case I get hacked. So there are standards out there that could cover reasonably well what we are all looking for, and meet a level, I think, that would provide security for anything but the greatest items out there. As was mentioned by Mr. Williams, having access into a system provided for us for companies that don't need to take something or machine it, but actually just need that data and that information can go into the government system sort of like the National Guard does. They have their little wall garden, we call it. A member of the National Guard can go in, get their CUI information in there, go out, be it their VPN, and now they have all the information that they need, and it has been in a secure environment. Mr. HAGEDORN. So I worked a little bit in the Treasury Department, and I have seen bureaucracies in action and usually the bureaucrats come up with lots of ideas in order to make sure that if something goes wrong they can, as you say, point the finger at somebody else. And I see a lot of that here. I see a lot of expense being pushed along to you, and just because if something goes wrong, they don't want to be blamed for it. And I think, you know, it is kind of telling when government comes up with these ideas here, we are going to put this regulation on you, we are going to make you do all these types of things, and oh, it is going to cost some money so, well, now let's go find funding streams in order to help you pay for that. I mean, we see this all day long. I think a reasonable standard would make sense. Most businesses, even the big ones, have issues here. They all need to do better in compliance and I think that people can figure that out. So thanks very much, by the way, for your service to the country and you had a very impressive resume. Took our Ranking Member an extra shot at it just to get it out. Thanks very much. Mr. DUNBAR. Thank you, sir. Chairman PHILLIPS. The gentleman yields back. And now we recognize the Ranking Member of the Subcommittee on Economic Growth, Tax, and Capital Access, Mr. Meuser, for 5 minutes. Mr. MEUSER. Well, thank you, Mr. Chairman. Thank the Ranking Member very much for holding this hearing. Thank you to the witnesses as well. So there are reports--we all know that cybersecurity is clearly an issue. Reports are, that I have reviewed, that 6 percent of U.S. military and aerospace contractors reported data breaches between 2016 and 2018. Ransomware attacks are up over 100 percent in 2020. All industries, by the way. That is for all industries. So it is a concern. DOD, however, seems to have created the CMMC mandates that are a major concern to all small businesses and contractors certainly sitting here, and in my district. In fact, it seems that some of the focus on compliance with these mandates is even truncating your actual ability to focus on actual cybersecurity. And as being in business for a lot of years, I understand that. These mandates coming from Washington, in this case the Department of Defense, don't take what your business about fully into consideration. How could they possibly, right? I mean, it is a one-size-fits-all approach. So, I am definitely not happy to hear that the Department of Defense is also not offering forums to have this discussion with you, right? Perhaps in a hearing maybe we can do that or create access so they can better understand your concerns. And, again, I have DOD suppliers in my district that have already, just in the last couple of years, spent tens of thousands of dollars living up to these requirements and trying to achieve them. And meanwhile, they don't necessarily even know what level they are at, and they are very concerned, even their midlevel suppliers of those who are supplying them, being able to maintain those costs. Everything that you are discussing sharing here. So Mr. Dunbar, I will just ask you this: Level one, we are talking about level one here, what is--do we have the Department of Defense's feedback on if level one is satisfactory, and for how long it will be because I know they are trying to roll into this with a--in a managed way over the next several years, right? So what do they say about you and suppliers that you know about maintaining level one at this point? Mr. DUNBAR. Well, I think you reached part of the problem, is we are not really hearing a lot. We have got some estimated dollars and some numbers out there tossed around to level one, and yet how long is it supposed to last, any of the real detail on it? We don't get a lot of that. As you mentioned, the technology, is that going to keep up, or are we going to keep chasing technology as we go along, and, therefore, chasing more regulations and more rules that we have to get reassessed for along the way which are just going to continue to increase costs? Mr. MEUSER. Speaking of cost, what is the cost difference, would you estimate, from level one, which many are saying here they believe would secure your systems and your companies versus say level three? Can you put a number on that? Mr. DUNBAR. Easily ten- to twenty-fold. Mr. MEUSER. Wow. Okay. And how much more secure would it be from level one to level three? Mr. DUNBAR. I don't really know specifically from a level one to level three how much more secure it would be. I know from where I am currently, and what I am paying for the setup I have, which is a pretty secure setup, according to--the person who handles my security is actually a past director at DCISC for the Department of Defense, so he is the one who set mine up, and he is the one who said that we have 77 of the 120 controls and have 90 to 95 percent of the issues. So he believes for very small companies that you could be looking at, you know, 5 to 10,000 a year maybe for your costs instead of, you know, having to reach up to this level and that same company could be at hundred-plus thousand dollars a year. Mr. MEUSER. Well, I think we can conclude that these measures are overly harsh and we do need to create a forum to have this discussion with DOD so we can work this out. I yield back, Mr. Chairman. Chairman PHILLIPS. The gentleman yields back. And that completes our first round of questioning. So, therefore, I will recognize myself for another 5 minutes. Mr. Singer, while companies like yours in the pipeline become accredited C3PAOs, there is a long ways to go until we have a substantial amount of them. So how likely is full implementation of CMMC by 2026, if there is a lack of assessors? Mr. Singer? Mr. SINGER. I forgot to unmute. Thanks for the question, sir. I think it is very difficult to get there with the current progress we are making. We have a hundred provisional assessors at this time, and we have two C3PAOs already through the process from doing a DOD assessment. And, by the way, the third-party assessors are going through that level three assessment, so we have to meet the 130 different practices. So I think it is very difficult. The timeline is very stretched. As I had said in my testimony, I think we need more than 8,000 assessment team members to even make this happen, and that would be starting from today. So the math just doesn't work. I believe that there does need to be some flexibility in how we are rolling this out to the third-party assessors, and we need to have some--you know, if we are going to try and meet that deadline, there needs to be quite a bit more flexibility by the DOD in trying to ramp this up and move this out. I also feel pretty strongly that not everybody, as we have talked about before, needs to be at level three. If you are a part component maker, a small business, and you are doing, you know, special processes like coatings, painting, and somebody-- a prime flows down a drawing to you and tells you, Put the label plate here on this, you know, equipment, all of a sudden you have now had to hit level three. So there is some work here that needs to be done on understanding the risk truly to the supply chain, and maybe a single part maker of a bracket doesn't need to be level three, but somebody that is making sub assemblies and more complex parts does need to be. So that would be my answer. Chairman PHILLIPS. Thank you, sir. And, Mr. Williams, while CMMC is a DOD initiative, we are beginning to see it in other solicitations, particularly for government-wide contracts like GSA's 8(a) STARS III contract. So how concerned should small businesses be of the CMMC Initiative being adopted by civilian agencies and becoming a de facto baseline for doing business with the Federal Government? Mr. WILLIAMS. Yes, I think that is certainly a possibility. You know, the rollout with CMMC at DOD has experienced challenges, as we have been covering in today's hearing, and I think it remains to be seen if they will hit the target of 2026 as Mr. Singer just said. I would view what is happening at DOD as a trial balloon. And if it went well at DOD, which certainly is an open question at this point, I wouldn't be surprised at all if it is expanded beyond DOD to all of government. Chairman PHILLIPS. All right. Thank you, sir. And with that, I will now yield to Ms. Van Duyne for 5 minutes. Ms. VAN DUYNE. Thank you very much. Mr. Singer, I appreciate your testimony here today. I just have a couple of questions. What is the penalty or the outcome for a small business that can't comply with the requirements? Mr. SINGER. Today, the penalty is that you are out of doing business with the DOD, period. Ms. VAN DUYNE. Okay. I mean, that is--I am seeing Mr. Dunbar shake his head as well. So I am going to ask actually the whole panel, can you point to one or two concrete things that we can do to make understanding these flow-down requirements easier for small business? Mr. Hagedorn had a great point, well, yes, we could just define reasonable and move forward from there. Can we be a little bit more specific on what you would need? And, Mr. Singer, we will go ahead and start with you. Mr. SINGER. Sure. Thanks for the question. I think it is really--I think the primes really need to step up and play a bigger role here. They have the resources and the teams, and they have done a lot of the background work on understanding what is required. And instead of just sending out a rep and certs or a letter to a small business saying you need to post a score in the supplier performance risk system, I think there needs to be more support and help for them and more of a guiding kind of process program that they implement for their whole supply chain to help them get compliant. Ms. VAN DUYNE. Ms. Wilson, do you have anything to add? Ms. WILSON. Yes, ma'am. To ensure that everyone is on the same page and have the same information. What we have right now is pockets of information going to various individuals, like I just heard from Mr. Dunbar, said most of the information is being flowed through LinkedIn. Some companies have LinkedIn and some companies do not. There needs to be concerted effort of communicating what the standards will be, what the costs will be across all industry, and filter down to the small business, and maybe a regional approach to be able to help understand that CMMC is here to stay, take away the fear, but communicate clearly what it really means to have this certification. Ms. VAN DUYNE. Awesome. Thank you. Mr. Williams? Mr. WILLIAMS. Thank you. Yes, I would like to make two points. First to address the comment about flow down. The interim DFARS clause for CMMC which was issued late last year directs prime contractors to flow down the CMMC level that is appropriate for the information that is being flowed down to the subcontractor. That gives a lot of discretion to the prime contractor to decide what is appropriate. I would like to see the final DFARS clause for CMMC prohibit prime contractors from flowing down a higher level than is absolutely necessary based on the information that is being provided to the subcontractor. And the second point I would like to make about the information that is being disseminated to the small business community, my experience has been that there have been town halls, as Mr. Dunbar mentioned, and I get the LinkedIn messages as well. There are other ways that information is being pushed out, but I think the problem--the challenge is that that messaging is blunted by the fact that we still have no answers for many of the critical questions. So rather than focusing on creating more forums for disseminating information, I think we need to focus on providing real hard information about how much this is going to cost and when are small businesses going to need it, what level are they going to need? Until we can answer those basic questions, I think, you know, the forums are going to be largely lost on the small business community. Ms. VAN DUYNE. Thank you very much, Mr. Williams. Mr. Dunbar, did you have anything to add? Mr. DUNBAR. Yes. One of the items with small business is a lot of small businesses work from, I will say remote locations. You may have an office where you have people working from home, several people at various homes. One of the big items that was brought up recently by one of the board members for the CMMC was that we will be subject to home inspections in order to pass CMMC. So now you have people doing home inspections in your own private homes. The risks beyond that on there are just, you know, incalculable. Another item to me that really piqued my interest there was our ability to protect ourselves during an assessment. Right now, an answer on the Board FAQ site basically states that an RP that helped us go ahead and put together our plan is not to be there to defend our plan. So if we get--you know, fail it, we are supposed to know this book again. We don't have an expert to know it. Ms. VAN DUYNE. Excellent. Thank you very much. I yield back. Chairman PHILLIPS. The gentlelady yields back. And now I recognize the gentleman from Pennsylvania, Mr. Evans, for 5 minutes. Mr. EVANS. Thank you, Mr. Chairman. Mr. Dunbar, what would you--what would be your recommendations for those businesses that are just learning about the Initiative? I would like to ask all of the panel that question. I will start off with you, Mr. Dunbar. Mr. DUNBAR. I honestly don't know that I have an answer for that, because trying to know find the information, it has not been clear enough to everybody where to get it. If I am getting it from LinkedIn, I mean, I first heard about it at an Army Corps Small Business Conference in 2019. Otherwise, I may not even know about it today. Mr. EVANS. Does any other panel--any comments or thoughts on that, any of the other panelists? Mr. SINGER. Sure, sir, I would like to make a comment. You know, I think one of the important things is for companies to find reputable businesses to help support them through this process, and, unfortunately, I think there is too much variation in the help that they are getting, as Ms. Wilson spoke of earlier also. I think also that, especially now, I think a lot of the level three companies are aware of this coming down, especially small manufacturers that are, you know, just now starting to really understand this because the letters are coming out from the primes. But I think a big gap is the people that are going to have to meet level one and they don't know it right now, and I think that should be a much more proactive reach-out to those folks. I mean, the DOD knows who they are contracting with in these areas, and I think they should take a more active role. Mr. WILLIAMS. Yes, Representative Evans, if I could just back up Mr. Singer's comments there, our primary recommendation to our small business clients is to get level one ready. The level one requirements really are basic things, like antivirus software and spam filters that we think all companies should be doing, regardless of whether you work with the Federal Government. In this day and age, you should be doing at least those basic requirements, and they are already in the FAR. The FAR requires these basic safeguards. That has been the requirement for a long time. So, this really, frankly, shouldn't be surprising, but I totally recognize that it is, because small businesses have so much to focus on. But these requirements are not new, and they are, generally speaking, not difficult to obtain for small businesses. So, we would like everyone to really focus on at least getting level one ready, because these are things you should be doing as a business. Ms. WILSON. And I would echo everyone's comment that has been made on the panel. I do make a concerted effort to share with small business owners to mention CMMC, and I mention it in the context of the necessary need for them to actually have it, but understand what it means and the implications, because right now, we just have black and white implications of saying if you don't have it, and your contract comes up for renewal, then you run the risk of losing your contract. And, so, putting that fear in them early on, maybe prompt them to move forward. But also I think from our perspective at T47, we have already proactively tried to secure something similar, certification. It may not be directly related, but to at least get us ready so that way when it comes down for us to have an audit, we are in a position to actually, pass the audit. So it is a challenge, and right now, because we don't have cohesiveness of information, it makes it a little more difficult for small businesses that just now are recognizing that they need it, or they know they need it but don't know how to secure it. Mr. EVANS. I yield back, Mr. Chairman. Chairman PHILLIPS. The gentleman yields back. And now I recognize the gentleman from Wisconsin, Mr. Fitzgerald, for 5 minutes. Mr. FITZGERALD. Thank you, Mr. Chair. I am going to start, Mr. Singer, as a fellow Wisconsinite, I have quite a bit of experience in working with obviously anywhere from major corporations down to, you know, one and two person Ma & Pa shops. But my question, I was talking a little bit to staff about this yesterday. We were kind of kicking around the idea that there might be a different level of security from State to State throughout the Nation, and I just wanted to get maybe your perceptions on, is there much interaction with the State of Wisconsin from your perspective? And if there are, what are the influences there? Because I think it would be valuable for Members of Congress to know kind of what is going on at the State level. Mr. SINGER. Thank you, sir. As a fellow Wisconsinite, it has been kind of fun starting a business in Wisconsin, and Minnesota too. But as far as--I haven't had a lot of interaction with the State government. I counseled them a little bit on CMMC. It has been new to them, in helping them to try and understand the issues around this for small business. One of the organizations that we work very closely with are the MEPs, the Manufacturing Extension Partnership programs. Every State has one. There is--and Puerto Rico has one. We have been working very closely with them to try and help get the small manufacturers in Wisconsin and Minnesota through the assessment so that they can accept awards from the primes. So I think that is really actually a good avenue to help small businesses is through the MEPs, especially the manufacturers. But I don't know that, you know, the States yet have really kind of figured out any good mechanisms to help fund or support the small businesses as of yet. Mr. FITZGERALD. Very good. Thank you. As anybody could probably answer this question, let me just direct it to Mr. Dunbar, though. And I apologize if some version of this was asked earlier. But cybersecurity, obviously, you can be a consultant, quote/unquote ``consultant,'' and I am wondering if you are seeing, because we are starting to hear that there are many different versions of this, and obviously many different levels of professionalism and knowledge. And I am just wondering if you could comment kind of, you know what is your take, kind of what is going on out there on the street? Mr. DUNBAR. Thank you, sir. Yes, you are 100 percent correct. There is a large fear in the small business community that the ``consultants,'' in quotations, are not all equal. I get inundated with emails daily from companies trying to convince me that I am not ready, I need to be--I am losing my contracts. I mean, blatant lies in your inbox constantly from companies. I call it the fear marketing. I have also seen things from--as one of the other members of the committee had mentioned earlier, you know, companies that--there are fraudulent companies out there, just that have no business. There was one, I think, the College of India was creating, We can get you CMMC certified. Mr. FITZGERALD. Right. Mr. DUNBAR. Like, okay, great. How is the College of India getting me CMMC certified? And that is a fear. We don't know where to go. We have been told, Oh, well, the only great place, the only authorized place is the CMMC-AB, if they are on their marketplace, that is the only place to get, that is legal, to get your consulting from. That is a whole separate issue, I believe. Mr. FITZGERALD. Yes. And, you know, to dovetail on that, so compliance, too, because it is kind of wide open as to what the cost could be associated with that. You know, you hear figures thrown around, like, Well, it costs a company $10,000 to comply, or it costs them $1 million to comply. That is not necessarily a good gauge, I don't think, on, kind of, you know, whether or not somebody is a legitimate consultant. But it sounds like that is kind of the range that is out there when a lot of these small businesses are considering how to become not only compliant, but protect ourselves, so---- Mr. DUNBAR. And I think you raise a good point because there is also a lot of companies out there trying to sell one- stop shopping, like, Oh, we have this program. You buy this program, you are CMMC-compliant. Mr. FITZGERALD. Right. Mr. DUNBAR. And that is not going to happen. Mr. FITZGERALD. Yes. Very good. Thank you very much. I yield back. Chairman PHILLIPS. The gentleman yields back, and that completes our questioning. So I will move to my closing statement. And I want to thank all of our witnesses for a very compelling testimony today and for illuminating the very issues that small contracting firms are experiencing as they try to bolster their cybersecurity. Recent high-profile attacks have made it very clear that the threat of malicious cyber actors is growing, and that is why we must ensure that companies in the DIB are prepared for all cyber threats that might come their way. But it is equally vital, equally vital that we do not deprive businesses like yours of critical opportunities in that process. We have got to work as a committee to increase cybersecurity preparedness across the DIB in a way that is not cost prohibitive to small firms. By achieving this, the small businesses will still have ample access to a lucrative marketplace while also protecting themselves against 21st century threats. I would ask unanimous consent that members have 5 legislative days to submit statements and supporting materials for the record. Without objection, so ordered. And if there is no further business to come before the committee, we are now adjourned. Thank you. [Whereupon, at 11:17 a.m., the subcommittee was adjourned.] A P P E N D I X [GRAPHICS NOT AVAILABLE IN TIFF FORMAT] [all]