The Defense Department is working on a new Cybersecurity Maturity Model Certification policy that will require its vendors to confirm their own systems have strong enough cybersecurity to protect the department’s secrets. A civilian agency counterpart to that would look very different from what the Pentagon is developing, says deputy federal CIO Margie Graves.
A similar program would be useful in the civilian space but would require a much different framework, according to Graves. “We, as a civilian community, cannot adopt DOD rubrics writ-large,” she said. “But there are some aspects of the civilian agencies – I would say, [the Homeland Security and Justice departments] and others in the law enforcement among them – that are similar. We could actually learn from the framework that’s being set up with DOD on that issue.”