Initiative to Create Secure Cloud Environment for Small Businesses
Next year, the Pentagon’s Office of Small Business Programs (OSBP) will launch a pilot project aimed at developing a secure, cloud-based environment for small contractors, who often struggle to meet the Department of Defense’s extensive cybersecurity requirements.
Building a Secure Cloud Platform
“We’re building [a] secure cloud that we’ll offer as a platform and environment for all small businesses that work with the Department of Defense,” said Derrick Davis, director of industrial cybersecurity for OSBP. While still very much a work-in-progress, the plan is to include a virtual desktop, secure communications, and other tools for use by smaller firms, Davis stated at the GovExec Cybersecurity Futures Forum on Wednesday afternoon.
OSBP’s Project Spectrum as a Foundation
The as-yet unnamed pilot will be operated out of OSBP’s Project Spectrum. Established by the defense policy bill for 2019, Spectrum provides online resources to educate contractors and a marketplace for government-vetted cybersecurity tools, but this pilot marked the first time it would build such a comprehensive suite of services. The initial plan is to start small, recruiting firms with prior experience working with the DoD — as Davis humorously noted, “all you in this room know that you need a doctorate degree just to navigate the defense contractor process” — who still need cybersecurity support.
Learning from the Army’s NCODE Project
One model that SBP is considering is the Army’s two-year, $26 million pilot project, NCODE, which is also focused on creating a secure cloud environment for small businesses.
“That’s a great program that they have; we’ve reviewed it within our office, we’re going to partner with those guys,” Davis mentioned at the GovExec conference. “I’m headed to the Pentagon after this to actually speak with the Army CIO, Mr. [Leo] Garciga, about NCODE.”
Addressing Cybersecurity Resource Gaps
The motivation behind both initiatives stems from the understanding that while large prime contractors can assemble extensive in-house cybersecurity teams, small businesses generally do not have the resources to employ cyber experts or invest in the latest security software.
“Especially just starting out, your laptop that you use to run your small business is also your [personal] laptop that you use to manage your family’s finances,” Davis explained. “You may even help your kid do their homework on your laptop.”
Vulnerabilities for Small Contractors
Even the smallest mom-and-pop shops working with the Defense Department may handle sensitive information or technology, or supply critical components for high-priority weapons systems. Therefore, aside from facing typical internet threats such as spammers and scammers, small firms contracted by the Pentagon might be targeted by “Advanced Persistent Threats,” as Davis warned: nation-states employing sophisticated techniques to extract vast amounts of defense-related data and seeking unauthorized access to secure networks.
“If we’re going to force companies to comply with CMMC [Cybersecurity Maturity Model Certification], we should also, on the flip side, offer assistance, and that’s what we’re trying to do,” Davis stated. “But … when we do something, everybody wants it to be perfect. The problem is, as you know, it takes time.”
A Call for Patience and Understanding
“Have patience and grace with us,” he told the GovExec audience. “We’re just trying to help.”
