The CMMC Accreditation Board has officially signed a no-bid, no-cost contract with the US Dept. of Defense after months of contentious negotiations between the parties. Because the contract was awarded outside the competitive bidding process, it is highly likely to be contested by potential competitors to the CMMC-AB.
Originally, the CMMC-AB was formed by way of a Memorandum of Understanding (MOU) with the DoD, which included language saying the document was not a contract. This was felt to have been done in order to avoid the contests and conflicts the AB and DoD will likely now face, as they move to a formal contract instrument. Despite the language, the MOU would likely have been legally enforceable if brought to court.
The DoD’s CMMC Program Management Office, led by Katie Arrington, grew frustrated with the CMMC-AB’s actions after ousting former Board Chair Ty Schieber. Schieber was Arrington’s former boss at Dispersive Technologies, and a donor to her failed US Congressional campaign, raising questions about conflicts of interest and cronyism. After Schieber’s departure, Arrington began attempting to exert more control over the CMMC-AB, and came to regret the MOU. She moved to cancel the MOU and replace it with a binding contract, which would have stripped the AB of much of its independence.
Arrington’s boss within the DoD, Ellen Lord, remained silent on the conflicts, despite having signed the MOU personally.
The conditions of the new “statement of work” (SOW) were rejected dozens of times by the AB, leading Arrington to threaten to dismantle the CMMC-AB entirely. Arrington held meetings with competing accreditation bodies, including ANAB and A2LA, as if scouting the CMMC-AB’s replacement. New leadership brought in after Schieber’s departure, including Acting Board Chair Karlton Johnson and Acting Treasurer Yong-Gon Chon, took a more pliant posture, and sources say they argued to comply with Arrington’s demands as a means of ensuring the AB’s survival. Johnson was supposed to relinquish his “acting” seat, but the AB had indefinitely postponed the formal Chair election while the SOW remained unsigned.
The contract has not been released, so its content is unknown, but an official release on LinkedIn by the CMMC-AB claims the contracted affirms the AB’s “role as the sole authorizing body for certifying and licensing of C3PAOs, as well as how training and certification of assessors and instructors will occur.”
Some have already questioned the legality of the arrangement, which would give complete control to a private organization over who can sell products and services to the Federal Government. This could conflict with a myriad of other regulations and laws, such as those that give priority award status to veteran-owned or minority-owned businesses. If the agreement was signed by “acting” CMMC-AB officers, rather than elected ones, this would also likely be raised in court.
The official press release also claimed some other structural changes were coming to the CMMC-AB:
Also included in the contract are requirements for creating a transparent, independent, and unbiased operational model to ensure the overall success of the program. The AB collaborated with the DOD, as well as other external organizations, to establish the operational framework.
Multiple interviews by Arrington suggested the AB was being split, and that key operations would be handed over to “ISO certified” bodies. It is not clear to what she was referring.
The official AB press release also claimed, twice, that the Board vote to sign the contract was “unanimous.” Sources report, however, that there were abstentions that were not tallied against the “unanimous” claim. The actual vote count has not been made public. In a cryptic post on LinkedIn, an unnamed official from the CMMC-AB quoted a dictionary definition of “unanimous” suggesting the decision was “held or carried by everyone involved.”
As it stands now, barring creative language in the contract, the CMMC-AB will operate in noncompliance to international accreditation rules previously required of it as part of the original MOU. The DoD previously demanded that the AB operate in accordance with ISO 17011, which prohibits an AB from simultaneously offering personnel certification. The AB rejected complying with that condition, and has launched a host of personnel certification schemes as a means of funding its operations. Unless either the accreditation of CMMC C3PAOs or the certification of personnel is divested, there is no way the CMMC-AB will be able to claim to operate under accepted accreditation rules.
It is thought the new contract may drop all requirements for the AB to be accredited, or to operate in compliance with accreditation rules, risking turning the scheme into a “diploma mill” type operation.
Oxebridge founder Christopher Paris has criticized the Dept. of Defense for attempting to solve “one of the biggest threats to US national security” while refusing to fund it.
Despite collecting revenue for the sale of its certifications and other programs, it is still not clear if the CMMC-AB has obtained official tax-exempt status with the IRS. The IRS still does not report any application filings by the AB.
