One of the most frequently asked questions I receive is:<\/p>\n
\u201cHow do I know if I need to be compliant with either the NIST 800-171 or CMMC frameworks?\u201d<\/i><\/p>\n
The bottom line is that if you possess controlled unclassified information (CUI) then your organization will likely have to fulfill these compliance requirements- even if you are considered a commercial off the shelf (COTS) company if you\u2019re required to do so by your clients. Unfortunately, it\u2019s not always clear to many organizations if they fall under this umbrella, so we\u2019ve developed a comprehensive guide to help clarify your compliance obligations to not only ensure you\u2019re in good standing with your existing contracts but are also able to bid for future contracts which will include both of these requirements.<\/p>\n
Our first recommendation is to simply reach out to your clients to learn if they currently require or anticipate you will be required to accomplish either NIST 800-171 or CMMC compliance. Based on our experience, company contracting officers or program managers for a contract are great resources to learn about what they expect from their vendors and if they anticipate incorporating these compliance requirements as part of their contracts. You should also learn if the clients themselves have NIST 800-171 or CMMC requirements related to your contract with them. If they do, it is likely that your contract with the client will also have this language, as both NIST 800-171 and CMMC both feature flow-down requirements to be included in subcontracts.<\/p>\n
If you\u2019re unsure or not comfortable reaching out to your clients to ask them about their compliance expectations, you can oftentimes find these requirements within your contract. By referring to Section H.27 (Facility, Personnel, and Systems Security Documentation), you\u2019ll find language indicating your potential compliance requirements and will want to keep an eye out for terms such as DFARS (7012), NIST, NIST 800-171, CMMC, and ITAR. In addition to this, you can also find additional compliance obligations by referring to your DD254 form which is an appendix within your contract.<\/p>\n
Last but not least there are three insights, recommendations and considerations you should keep in mind as part of your compliance strategy to help determine if your organization will likely be required to address these compliance requirements and position itself for long-term success.<\/p>\n
1. Consider NIST 800-171 & CMMC as a competitive marketing advantage:<\/strong><\/p>\n If you determine that the NIST 800-171 or CMMC are not an immediate requirement for your organization and are not included in any of your current contracts, then it may be a good idea to consider implementing them as a competitive marketing advantage. At TSI, we became CMMC Level-3 compliance ready to distinguish ourselves in the market and almost half of our NIST\/CMMC DoD clients are doing so for the same reason. Although they\u2019re not required to be compliant today, they choose to do so from a strategic marketing decision to improve their chances of success in an increasingly competitive market that if not today, will very soon require contractors to be compliant.<\/p>\n 2. Be aware of the timeline to implement the NIST 800-171 & CMMC frameworks:<\/strong><\/p>\n In the worst-case scenario that your organization has done very little to nothing at all to become compliant today, it very well could take anywhere from\u00a012-18 months\u00a0to implement the technical and programmatic controls and solutions to accomplish compliance.<\/p>\n For example, from a technical standpoint, of the 130+ NIST 800-171 & CMMC controls, there are at least 25+ technical services or tools required to adequately address them with many of them requiring the expertise of an MSP or MSSP, to purchase and successfully implement them. Microsoft GCC High is one such frequently overlooked solution that will be required for organizations with CMMC + ITAR requirements and can only be purchased from 9 registered Microsoft GCC High Companies and implemented by a limited number of organizations nationally- TSI is one of them.<\/p>\n Regarding the programmatic component of the CMMC, the policy development, supporting documentation, and process development for each of the 130+ CMMC controls was one of the primary areas of focus for our assessors and on average, we estimate it takes 120 hours to complete and generally requires a CISSP-level Security Engineer or CISO to complete an audit-ready Security and Compliance Program. Without experience in developing these programs, it will take significantly longer. In addition to this developing a Security and Compliance Program for CMMC 2.0 Level-2 requires that the program is managed and sustained over time. A complete program includes requisite policies, practices, procedures, strategic implementation plans, process development and resources to manage and sustain the program and its associated controls. Developing a program with this level of rigor, detail and congruence requires CISO level knowledge and experience. As our own assessment ended, we received excellent comments on our program including how it has made our assessor\u2019s job much easier!<\/p>\n 3. Determine your IT provider\u2019s RPO status and CMMC readiness:<\/strong><\/p>\n If you\u2019re currently working with an IT provider that isn\u2019t an\u00a0CMMC-AB RPO<\/a>\u00a0today, it may benefit you to partner with one. A CMMC RPO is registered with the CMMC Accreditation Board and have undergone a background check to ensure they fulfill the basic requisites to provide NIST\/CMMC services to the DIB. In addition to this and even more importantly, in order for them to continue providing your organization with services- especially if those services or solutions address your compliance requirements- they will also need to adhere to the same level of NIST 800-171 and CMMC level that is required of yourself if they have (verified or unverified) access to your CUI. To ensure your organization is adequately prepared for an audit, you should speak to your IT provider as soon as possible to clarify if they meet these standards and if they\u2019ve undergone a 3rd\u00a0party audit of their systems attesting their ability to be CMMC certified ready when that time comes. Overlooking this critical detail could significantly impact your organization\u2019s NIST\/CMMC implementation process from both a time and financial standpoint.<\/p>\n As a nation-wide partner to the DIB, we hope that our guidance here has helped clarify your compliance obligations so you can take the appropriate measures to improve your security posture and ensure that your organization is able to pursue and keep your DoD contracts.<\/p>\n Feel free to check out TSI\u2019s NIST 800-171 & CMMC Services Page<\/a> to learn how we can help support your organization\u2019s compliance objectives.<\/p>\n If you have any questions, please give us a call at 508-543-6979<\/a> or send us a message here to get started.<\/p>\n<\/div>\n\t<\/div>\n<\/div>\n\n\t\tGet in Touch with TSI<\/span>\n\t<\/h3>\n\t<\/div>\n<\/div>\n