NCODE - Overview Brief - AUG 25.pdf

BE ALL YOU CAN BE

NEXT-GENERATION COMMERCIAL

OPERATIONS IN DEFENDED ENCLAVES //

NCODE

Establishing a Verified Marketplace AUGUST 2025

UNCLASSIFIED

UNCLASSIFIED

Controlled by: ASA(ALT) Controlled by: ADASM/DES CUI Category: UNCLASSIFIED Distribution Dissemination:

POC: James Lewis / ncode@army.mil

Overall Classification: UNCLASSIFIED

ASA(ALT), DCIO

NCODE Overview

NCODE is designing a standardized pathway for small businesses in the Defense Industrial Base (DIB) to achieve CMMC at various levels by building a marketplace of verified service providers.

UNCLASSIFIED

UNCLASSIFIED

• Small businesses struggle to meet cybersecurity requirements due to cost and/or skills gaps.

• DIB is facing increasingly sophisticated attacks from our adversaries, and small businesses are a prime target.

• The government cannot sustainably subsidize cost for small businesses.

NCODE’s goal is to reduce SB burden to implement cybersecurity to protect the government’s data.

Challenge: Small businesses in the DIB face security risks.

Secure operating environment for DIB partners

Costs at scale Inherited Controls Standardized pathway to CMMC Tailored capabilities for SBs

Action: Build a Marketplace of verified service providers.

Cybersecurity Requirements Can Dissuade Small Businesses

Quantity of SB with active Army contracts decreased by 23.6% since FY19 a

• SBs report increased regulatory burdens (e.g., cybersecurity-related) discourage participation b

Army investment in SB is relatively static.

• Fewer, consolidated SB

• Reduces competition

• Reduces innovation

• Complicates supply chain

$2

$7

$12

$17

$22

$27

$32

10,000

11,000

12,000

13,000

14,000

15,000

16,000

FY19 FY20 FY21 FY22 FY23

To ta l C on tr ac t V al ue

Bi lli on s

N um be r o f A rm y

SB

s

Decline in SB Quantity Over Time

UNCLASSIFIED

UNCLASSIFIED

$24B $23B

15,714 SBs

12,003 SBs

References:

a. Based on data from Army Office of Small Business Programs

b. HigherGov Analysis https://www.highergov.com/reports/small-business-trends-2022/ https://www.highergov.com/reports/small-business-trends-2022/ https://www.highergov.com/reports/small-business-trends-2022/

$90K

$18K

$60K

$12K

$20

$40

$60

$80

$100

$120

$140

$160

Estimated CMMC L2 Cost w/out

NCODE

Estimated CMMC L2 Cost w/ NCODE

Th ou sa nd s

CMMC L2 Costs for SB, Yr 1

Initial Assessment & Implementation Certification Licenses

NCODE Can Improve DIB Cybersecurity Affordability

NIST 171/CMMC 2 costs ≥ $150k for most businesses in year-1 a

$88,840 is the median, annual value of Army contracts for SBs b

NCODE could offset 80% of costs

Additional Notes:

• Baseline estimate for 171/CMMC-2, CMMC-3 would cost more.

• Historical upkeep costs for 171/ CMMC-2 often exceed $100,000.

• Higher cyber risk SBs may face a collective total of $847 million in meeting CMMC 2 requirements

UNCLASSIFIED

UNCLASSIFIED

Median Value of Contracts

$89k

3 $35k

≥$150k1

References:

a. 2024 National Defense Industrial Association survey

b. Army Office of Small Business Programs

$5k

Most Army SB Cannot Afford Risk Mitigation

12,003 Army SBs with active FY23 contracts a

10,139 SBs cannot feasibly cover CMMC-2 costs with Army-derived revenue

• Assuming an 8-9% net margin, a company would need roughly $2M to break-even with CMMC 2

Of 10,139 SBs, 6,229 are medium to high cyber risk

The majority of Army SB with active contracts are medium to high cyber risk and face CMMC-2 affordability challenges

FY 2023 Army SBs With Direct Contracts

UNCLASSIFIED

UNCLASSIFIED

12,003 SB

(120K users)

(100%)

10,139 SB

(101k users)

(83%)

6,229 SB

(62k users) (52%)

Weapon component manufacturers

IT services

Software development

Health providers

Agriculture

Food Services

All FY23 Army SBs

FY23 SBs with <2M in Army contracts

FY23 SBs with <2M and are medium or high cyber risk

Reference: a. Army Office of Small Business Programs

NCODE Verified Marketplace for Commercial Solutions to SB Security

UNCLASSIFIED

UNCLASSIFIED

Verified External Service Providers

FIPS-Compliant MFA FedRAMP Moderate

ITAR Compliant

Small Businesses

Diverse business needs

1. Government facilitated marketplace of external, commercial verified service providers with validation and quality assurance

2. SB chooses providers based on individual business needs (e.g., specialized tools, advanced security, etc.)

3. Providers and SB share security control responsibility, at significant cost saving

NCODE

MARKETPLACESB A

(software dev)

20% NIST Controls 80%

Business-to-Business Driven

Shared Responsibility3

VESP1

Basic

Productivity

VESP2

Advanced

Tools

VESP3

Higher

Security

SB B

(basic office)

SB C

(critical tech)

Rapid Pathway to Verified Marketplace

UNCLASSIFIED

UNCLASSIFIED

• Validate inherited controls satisfy CMMC and effectively streamline assessments.

Cost: $250-$300K Partners: DoD CIO, HQDA, USD (A&S)

Demonstrate Feasibility | 4-5 months

• Establish criteria for verified external service providers

• Formalize pathway for inheritance of NIST controls by Small Businesses Cost: <$100K + ASA(ALT ) Staff Partners: DoD CIO, USD(A&S), HQDA + Coordination and Staffing with Cyber AB

Institutionalize Certification Pathway | 6 months

• Create marketplace of verified providers where small businesses can select best-fit capability

• Reduce the cost of CMMC via inherited controls and focused assessments Cost: TBD (Minimal + ASA(ALT ) Staff) Partners: DoD CIO, TBD partners

Establish & Launch Marketplace | 8 months Co nc ur re nt L in es o f

Ef fo rt

NIST 171 Section / Control Family ALL

OBJECTIVE

Full Coverag e

Shared Coverag e

3.1 Access Control 22* 15 6

3.2 Awareness & Training 3 0 3

3.3 Audit & Accountability 9 9 0

3.4 Configuration Management 9 9 0

3.5 Identification & Authentication 11 11 0

3.6 Incident Management 3 0 3

3.7 Maintenance 6 6 0

3.8 Media Protection 9 8 1

3.9 Personnel Security 2 0 2

3.10 Physical Protection 6* 5 1

3.11 Risk Assessment 3 2 1

3.12 Security Assessment 4 3 1

3.13 System & Configuration

Protection 16 16 0

3.14 System & Information Integrity 7 7 0

TOTALS 110 91 18

PERCENTAGE 100% 83% 16%

Register Interest https://www.army.mil/ncode

UNCLASSIFIED

UNCLASSIFIED