Comparing Section 889’s Huawei Ban and the Cybersecurity Maturity Model Certificate: The Challenge of Pursuing Cybersecurity Through Friend-Shoring
Open Access DepositedThe U.S. Government’s recent efforts to ensure the cybersecurity of government data maintained by government agencies and their contractor partners include two major cybersecurity measures: Section 889 of the 2019 John S. McCain National Defense Authorization Act (Section 889) and the Cybersecurity Maturity Model Certificate (CMMC), forthcoming from the Department of Defense (DoD). To protect data from theft by the Chinese government, Section 889 excludes from U.S. procurement certain Chinese manufacturers of telecommunications and video-surveillance equipment, including the Chinese Telecommunications giant, Huawei Technologies Company. In practice, Section 889 resembles other “friend-shoring” measures that protect critical supply chains by moving those supply chain from geopolitical rivals to domestic and friendly markets. CMMC proceeds by very different means, as it will require contractors maintaining unclassified DoD information to adopt a suite of best practices promulgated by the National Institute of Standards and Technology (NIST). This paper documents lessons learned from the implementation of Section 889, as identified through interviews with professionals in federal agencies and industry, and the evaluates the applicability of those lessons to CMMC’s implementation. This evaluation shows that CMMC and Section 889 will likely share only those effects that would arise with the implementation of any new requirement. By contrast, the most serious challenges resulting from Section 889—including overbroad application and the consequent disruption of activities not covered by the statute—stem from its specific “friend-shoring” features. As a result, these challenges likely will not emerge under CMMC. Policymakers considering future cybersecurity measures should consider this lesson, that a cybersecurity regime based on best-practices avoids the difficulties, costs, and risks that friend-shoring regime can be expected to create.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.
| Thumbnail | Title | Date Uploaded | Visibility | Actions |
|---|---|---|---|---|
|
|
Anderson_gwu_0075M_16707.pdf | 2024-10-02 | Open Access |
|