The DIB and NSIB and their relationship to CUI and CMMC

This is an overview of the Defense Industrial Base (DIB) and the National Security Industrial Base (NSIB) in the United States and its relationship with the Department of Defense and CMMC 2.0 certification because these organizations are defined as the Authorized Holders of Controlled Unclassified Information (CUI) .

Overview of the Defense Industrial Base (DIB) in the United States

The Defense Industrial Base (DIB) in the United States is a critical and multifaceted network that is pivotal in supplying the U.S. government with military weapons systems, products, and services. This extensive industry consists of over 100,000 companies, subcontractors, and government-owned facilities actively involved in research, manufacturing, and continuous improvements in various subsystems and components crucial for military operations. For example, companies within the DIB produce military-grade vehicles, aircraft, weapons, and advanced technology systems that contribute to the strength and capabilities of the U.S. The U.S. DIB provides defense-related materials, products, and services to the Department of Defense (DOD).

The DIB represents a significant segment of the U.S. and global market, with U.S. military spending totaling $801 billion in 2021, accounting for approximately 38% of the global military expenditure. This underscores the DIB's immense economic impact and reach, supporting national security and contributing to the broader global defense landscape. The DIB's contributions extend beyond national borders and substantially influence international security and stability.

Moreover, the Institute for Defense and Business offers specialized training programs that focus on strategic thinking, technology, and innovation for logistics and supply chain capabilities, catering to professionals in the defense industry. These programs underscore the commitment to continuous learning and process improvement within the DIB, ensuring that the sector remains at the forefront of advancements in defense technologies and capabilities.

The DIB is integral to the U.S. military and national security strategy, positioning itself as a cornerstone of the country's defense capabilities and a significant player in the global defense industry. The industry's diverse and extensive network reflects its significance in shaping the landscape of military capabilities and technological advancements, emphasizing its essential role in the defense sector.

Components of the Defense Industrial Base

The Defense Industrial Base (DIB) is a complex network encompassing a wide range of organizations, from large corporations to small businesses and domestic and foreign entities, all working under the Department of Defense. These entities are involved in various activities such as research, development, manufacturing, and improvement of multiple subsystems and components crucial for military operations and national security.

For example, the DIB's collaboration with the Institute for Defense and Business in offering specialized training programs demonstrates the industry's dedication to enhancing its capabilities and expertise in supporting national and global defense initiatives.

Furthermore, the sector-specific plan for the Defense Industrial Base outlines the risk management framework and is developed by the Department of Defense. This strategic approach underscores the industry's commitment to operational excellence and risk mitigation, ensuring the seamless functioning of the DIB in delivering critical products and services to the U.S. government and the broader defense landscape.

The DIB and National Security

The Defense Industrial Base (DIB) plays a crucial role in shaping the national security strategy of the United States. By providing diverse products and services for military operations, the DIB ensures that the country's armed forces have the necessary equipment and resources to deter war and protect national security interests.

The industry's emphasis on continuous learning and process improvement underscores the DIB's significant role in the context of national security. This focus on innovation since 2015 has been instrumental in enhancing the effectiveness and efficiency of military weapons systems, thereby bolstering the nation's defense capabilities. For instance, the DIB's collaboration with the Institute for Defense and Business in offering specialized training programs underscores the industry's commitment to fostering innovation and expertise, positioning itself at the forefront of advancements in defense technologies and capabilities.

The DIB's contribution to national security extends beyond domestic implications and resonates globally. The industry's pivotal role in shaping the broader defense landscape emphasizes its multifaceted significance, positioning it as a significant player in the global defense industry.

Current Challenges in the DIB

The Defense Industrial Base (DIB) in the United States encounters many challenges that hinder its ability to support the defense industry efficiently. One of the significant challenges is the persistent labor shortages across various sectors within the DIB. This shortage is particularly prevalent in science, technology, engineering, and mathematics (STEM) fields, where skilled labor is vital for developing and producing advanced military technologies. For example, defense companies struggle to find and retain qualified professionals to fill positions requiring specialized cybersecurity, aerospace engineering, and artificial intelligence expertise.

Furthermore, the DIB is burdened by cumbersome regulations that require companies to work with the Defense Department. These regulations often entail complex compliance procedures, reporting requirements, and quality control standards, which can be time-consuming and resource-intensive for businesses operating within the DIB. Navigating through these intricate regulatory landscapes adds administrative overhead. It can impede the agility and flexibility of companies in the DIB, impacting their competitiveness and ability to respond swiftly to evolving defense needs.

Economic instability poses a significant challenge to the DIB, with factors such as budget instability, inflation rates, and the impact of the federal government's frequent use of continuing resolutions creating uncertainties for defense companies. These economic uncertainties can disrupt long-term planning, research and development initiatives, and investment in critical capabilities. Rising inflation rates and budget instability can erode the purchasing power of defense budgets, affecting the DIB's ability to sustain innovation and deliver cost-effective solutions to the Department of Defense.

The National Security Industrial Base (NSIB)

The National Security Industrial Base (NSIB) and the DIB are closely related concepts but have distinct scopes and focuses within U.S. national security.

The DIB primarily encompasses the network of private-sector and government-run facilities, capabilities, and activities essential for producing, developing, and maintaining military weapons systems and technology. The National Security Industrial Base (NSIB), on the other hand, represents a broader concept. It includes traditional defense contractors and suppliers and encompasses various industries and sectors contributing to national security. This includes technology sectors, research and development communities, academia, and other industries that may not directly deal with traditional military defense but are crucial for the nation's overall technological and strategic superiority. The NSIB is oriented more towards innovation and technological advancement, integrating commercial and defense-related efforts to ensure national security. This integration includes focusing on artificial intelligence, cybersecurity, biotechnology, and other emerging technologies vital for modern national security strategies.

Moreover, the NSIB's role in driving innovation and technological advancement is crucial for ensuring that the United States remains at the forefront of national security preparedness and resilience in an increasingly complex global landscape. The industry's commitment to fostering collaboration and innovation underscores its pivotal role in shaping the trajectory of the defense industrial base, reinforcing its significance in safeguarding national security and global defense capabilities.

What is the breakdown of these organizations and who deals with CUI?

While there are over 100,000 organizations that fit the categories of DIB or NSIB, we only surveyed a bit over 8,000 of those organizations to determine the industry breakdown. We found over 112 industry categories are known to use CUI, with the top 50% of all people surveyed falling within 14 industry categories.

Industry breakdown for the DIB and NSIB

The roles within these categories are fairly the same. We searched various job sites for any jobs pertaining to the management or auditing of CUI within the 14 industries noted above. According to our research, the following roles should be involved in the CUI program:

• CUI Program Manager:The CUI Program Manager is responsible for overseeing the overall CUI management program within the organization. This individual should have a comprehensive understanding of CUI requirements and compliance frameworks.
• CUI Training and Awareness Coordinator:The CUI Training and Awareness Coordinator is responsible for developing and implementing training programs to educate employees on CUI handling and security.
• CUI Compliance Officer:The CUI Compliance Officer is responsible for ensuring that the organization meets all the necessary compliance requirements related to CUI.

The individuals who hold these roles should work together to develop and implement a comprehensive CUI management program that meets the needs of the organization.

Those are the roles inside the Authorized Holder. Just as important to CUI is the Certified Third-Party Assessment Organization (C3PAO) responsible for conducting CMMC Level 2 Certification Assessments and issuing certificates of assessment for Organizations Seeking Certification (OSCs). These organizations play a crucial role in verifying that OSCs are conforming to the security requirements to protect CUI as specified in the program's regulations.

The DIB and NSIB’s challenge with protecting CUI

These organizations face the following challenges in monitoring and auditing CUI activities:

• Data Volume and Complexity:Organizations dealing with a large volume of CUI may find it challenging to manage and analyze the vast amount of data generated by monitoring and auditing processes.
• Resource Constraints:Monitoring and auditing CUI activities require dedicated resources, including personnel, tools, and technologies. Organizations need to allocate sufficient resources to ensure effective monitoring and auditing processes are in place.
• Privacy and Data Protection:Organizations must strike a balance between monitoring and auditing CUI activities and respecting individual privacy rights. Implementing appropriate safeguards to protect personal information and ensure compliance with relevant data protection regulations.
• CUI Handling Procedures:Organizations must establish clear policies and procedures for handling both FCI and CUI to ensure that all employees are aware of their responsibilities and the appropriate methods for handling CUI.

This is where CMMC 2.0 comes in to play. The Cybersecurity Maturity Model Certification (CMMC) program, developed by the Department of Defense (DoD), is specifically aimed at enhancing the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC program protects sensitive, unclassified information the Department shares with its contractors and subcontractors. These entities must implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information they handle.

The program aligns with the DoD's information security requirements and enforces the protection of sensitive, unclassified information. Suppose a company in the DIB does not process, store, or transmit Controlled Unclassified Information (CUI) but does handle Federal Contract Information (FCI). In that case, it must perform a CMMC Level 1 self-assessment and submit the results annually.

For members of the NSIB that are not directly part of the DIB or do not handle CUI or FCI as defined by the DoD, CMMC certification is not currently a mandated requirement. However, given the increasing cyber threats and the emphasis on cybersecurity across all sectors, it could be beneficial for these organizations to voluntarily adopt similar cybersecurity practices. Adopting such standards could enhance their cybersecurity posture and potentially make them more competitive and resilient in the national security landscape.

CMMC 2.0 lays out a suite of guidelines to overcome the challenges of protecting CUI. Along with that, organizations such as the US’s NIST have developed methods for creating Compliance as Code tools utilizing the OSCAL, STIG, and CCE languages.