In 2013 the DoD created a security requirement in the Federal Acquistion Regulations called DFARS 252.204-7012 and then a few years later, NIST released a security requirement named SP 800-171. While both of these were a start to improving security for the defense industrial base, they didn't solve the problem.

Below is the Pentagon's explanation of the CMMC Maturity Processesion with higher levels building on the lower levels.

 

Likewise, here is the maturity progression for practices with each level building on the level below it:

 

• The CMMC level of certification required for each procurement will be specified in the RFI and RFP upon release.
• Contractors will be required to meet the certification level at time of award.
• Unless a higher level is specified, all contractors and sub-contractors must meet at a minimum CMMC Level 1.

In January 2020, the official CMMC Levels and requirements were be released to the public. The government will determine the appropriate tier (i.e. not all contracts require the highest level of security) for the contracts they administer.

 For more information, a full list of frequently asked questions can be found HERE.

How to Prepare for a CMMC Audit

Option 1: Do it Yourself and Meet Requirements In-House

DoD contractors or suppliers who have the resources and IT staff available, can meet the appropriate CMMC level of cybersecurity in-house. Internal IT departments can use the "Self Assessment Handbook - NIST Handbook 16" provided by the National Institute of Standards and Technology (NIST). This handbook was created by NIST with the intention of assisting U.S. DoD contractors who provide products and services for the Department of Defense. Unfortunately, this handbook only covers NIST SP 800-171 Rev. 1 (A good starting point for certifications up to CMMC Level 3) and there is currently not a Self Assessment Handbook for NIST SP 800-171 Rev. B. However, a draft of the Rev. B can be found HERE. Note that this will not get you certified. If that process is successful, you will be awarded a certification at the appropriate level.

Option 2: Work with a CMMC Consultant

For many DoD contractors, the most effective way to meet the CMMC cybersecurity requirements is to outsource the task to a consulting partner that has the appropriate expertise and can work with you to become compliant. Remember that DoD contractors remain ultimately responsible for ensuring that their company meets the appropriate cybersecurity requirements, so it is essential to choose a provider that is reputable. Again, you will have to engage a third party for the actual certification process.

CyberCecurity, LLC is one such cybersecurity cconsulting company.

The Risk Assessment or Gap Analysis

The first step towards compliance is to determine how close the contractor is to full compliance. This process is called the risk assessment or gap analysis. Gap analyses are designed to discover areas where the company is not fully compliant with the regulations.

The results of the gap analysis may reveal issues related to:

• How access to information systems is controlled
• How managers and information system administrators are trained
• How data records are stored
• How security controls and measures are implemented
• How incident response plans developed and implemented
• And much more

Without a gap analysis, it's impossible to know what changes an organization needs to make before it meets the required CMMC Level. The gap analysis provides a roadmap to becoming compliant. Remember that the CMMC requirements will require compliance with different subsets of the NIST SP 800-171 requirements plus additional requirements out of documents such as NIST SP 800-53 Rev 5, depending on the CMMC certification level required.

Ongoing Cyber Security Monitoring and Reporting

Certification is a point-in-time event. Even if it covers some historical period like an AICPA SOC Type 2 audits do, it doesn't mean that you will be compliant in the future.

The DFARS also require almost instant notification (within 72 hours) of a security event to your prime contractor or to the government. Part of being compliant is being able to respond to these incidents in a time frame and with the required data to the appropriate party.

The Importance of Passing the First CMMC Audit

For many companies, DoD contracts make up a substantial percentage of their revenue and because CMMC certification will now be a requirement in many cases for bidding on contracts (check with your contracting officer), it's extremely important that contractors become certified. If a contractor fails a CMMC audit, they may be unable to offer products and services to the DoD until they do become certified.

CMMC Audit Preparation & Assessment Services

CyberCecurity, LLC is a full-service cybersecurity company that offers a wide range of cybersecurity and privacy services, including various certification services. More information about our certification services can be found at: https://www.cybercecurity.com/business-cybersecurity-certification- program/.

While no company has yet been authorized by the DoD to provide full CMMC certification services, CyberCecurity, LLC intends to be amongst the first authorized CMMC certification certifiers. In the interim, we are now able to offer you the following services:

• CMMC pre-assessments.
• Development of a SSP and POA&M
• Implementation of the NIST 800-171 and anticipated CMMC requirements

Accomplishing the above items will facilitate the rapid passing of a CMMC audit and allow your organization to bid on and be awarded new DoD contracts. It will also make your company more competitive for DoD contracts.

Have more questions?

Here is a link to the Office of the Under Secretary of Defense for Acquisition & Sustainment Cybersecurity Maturity Model Certification FAQ page.

Please call us for more information or if you have questions: