Why the DoD Wants Security Protection Data Protected Like CUI

The CMMC proposed rule introduces a concept some defense contractors find puzzling. Security protection data.

This category includes vulnerability scan results, system security plans, network diagrams, firewall configurations, and endpoint security settings. Under 32 CFR Part 170, when an external service provider handles security protection assets but doesn’t process, store, or transmit CUI directly, those services are assessed as part of the contractor’s own CMMC assessment. ESPs can also choose to obtain their own CMMC Level 2 certification, which reduces the assessment burden. Certified ESPs are listed on the MSP Collective.

Some contractors have questioned why security information gets this level of attention.

The answer comes from real-world patterns that show exactly the threat the DoW is trying to prevent.

The Intelligence Value of Security Data

When you work with any third party on cybersecurity, you share detailed information about your security posture.

Your System Security Plan describes how you protect CUI. Where it’s stored. How it’s encrypted. Who has access. What controls are in place.

Your network diagrams show what systems connect to what. Where your boundary is. What’s exposed to the internet. How traffic flows through your environment.

Your firewall rules reveal permitted and blocked network traffic. Your vulnerability scan results show exactly where your weaknesses are.

Your physical security documentation describes locks, access controls, camera placements, guard rotations, and facility layouts.

For an adversary wanting to access your CUI, this information is invaluable. It’s a roadmap for attack. It identifies the weakest points. It shows what defenses they’ll need to bypass.

Patterns Worth Watching in the Provider Ecosystem

As CMMC has matured, the ecosystem of consultants, RPOs, and supporting service providers has grown quickly. Most are legitimate. Some warrant a closer look.

A few patterns are worth watching for.

• US business addresses that resolve to mailbox services or strip malls with no actual office presence
• Ownership traceable to foreign jurisdictions
• Principals whose social media or public profiles place them outside the country
• No verifiable consultant backgrounds, clearances, or US-based staff records
• Vague answers about where data is stored or who has administrative access

These signals don’t automatically mean a provider is illegitimate. They do mean a contractor should ask harder questions before sharing security documentation.

The business model is straightforward from an intelligence perspective. Defense contractors need help. They’ll share sensitive security information with helpers. Position yourself as a helper, and contractors voluntarily hand over exactly the information an intelligence service would want.

GRC Platforms Present Similar Risks

In 2020 to 2021, as CMMC requirements were emerging, numerous GRC platforms launched to serve the market.

These platforms let contractors enter their System Security Plans, upload artifacts, store vulnerability scan results, and manage compliance documentation. Convenient tools that centralize exactly the information that creates intelligence value.

One platform in particular was among the top three or four in the market. It specifically advertised for CMMC compliance. It targeted US defense contractors.

Research revealed the platform’s ownership traced to foreign interests. The company was positioned to collect vulnerability data and security documentation from defense contractors across the industry.

When publicly questioned about this, the company threatened legal action, then disappeared.

https://youtu.be/naQfeSmrPug

Why This Matters for the CMMC Rule

The CMMC proposed rule’s treatment of security protection data makes more sense in this context.

The DoW isn’t being paranoid or bureaucratic. Foreign adversaries are actively trying to gather security information from the Defense Industrial Base, and the rule is designed to acknowledge that reality.

Posing as a CMMC consultant or GRC platform is efficient.

• Legitimate-appearing business relationship
• Contractors voluntarily share data
• Complete picture of security posture
• Direct access to vulnerability information
• Scalable across many contractors

Treating ESPs that handle security protection assets as part of the contractor’s CMMC scope, or pointing contractors toward Level 2 certified ESPs through the MSP Collective, raises the bar. It doesn’t eliminate all risk, but it gives contractors a clearer way to evaluate who they’re trusting with sensitive information.

The Current State of Provider Certification

The pool of certified providers is still small. The organizations authorized as C3PAOs have all passed CMMC Level 2 assessment by DCMA DIBCAC, but their numbers are modest compared to the overall cybersecurity service provider market.

RPOs have even less demonstrated compliance. Some have been working toward Level 2 for years and likely operate at that level internally. Third-party verified assessments are rare.

GRC platforms present particular challenges. Many aren’t FedRAMP authorized. Their data centers may be anywhere. Their administrative access may be uncontrolled. The platforms that look most concerning from an intelligence perspective often lack any independent security verification.

Due Diligence Recommendations

Before sharing security protection data with any external party, conduct thorough due diligence.

Verify ownership and location. Research the company. Who owns it? Where are they actually located? Does the US address resolve to an actual office?

Research company background. How long have they existed? What’s their track record? Can you verify their claims?

Check consultant credentials. Are the people you’ll work with actually qualified? Can you verify their backgrounds?

Evaluate platform security. For GRC tools, are they FedRAMP authorized? Where are their data centers? Who has administrative access?

Ask about their own compliance. If they handle security protection data, what’s their own CMMC status? Have they been assessed? Are they listed on the MSP Collective?

Trust your instincts. If something feels off, it probably is. Red flags exist for a reason.

The Broader Lesson

The security protection data requirement isn’t arbitrary bureaucracy. It reflects real threats to the Defense Industrial Base.

Foreign intelligence services have recognized that CMMC creates opportunities. Contractors need help. They’ll share sensitive information with helpers. Position yourself as a helper, and collection becomes easy.

The DoW is trying to close that vector. Treating security protection assets as part of the CMMC scope creates accountability. It doesn’t solve everything, but it raises the bar.

Defense contractors should welcome this protection, even when it creates inconvenience. The alternative is voluntarily handing intelligence to adversaries while thinking you’re getting compliance help.

Kieri Solutions is one of few authorized C3PAOs in the United States. We passed our own CMMC Level 2 assessment with DCMA DIBCAC. When we discuss security protection data requirements, we’ve demonstrated compliance ourselves.

Working with consultants or platforms? Verify their credentials and security posture before sharing sensitive information.

Schedule a consultation to discuss whether the KCD fits your compliance needs. kieri.com/schedule-consultation