At its core, the CMMC is designed to be an assessment model and certification program intended to clarify the degree in which contractors safeguard both their own and customers\u2019 CUI.<\/p>\n
As always, and as with anything related to IT or compliance, it\u2019s a recent progression that will require you to keep a few key things in mind.<\/p>\n
Maybe the most important factor to understand about all of this is that, unlike previous years, the various contracting authorities that you\u2019re working with will NOT accept an SSP (System Security Plan) and\/or POA&M (Plan of Action and Milestones) as evidence of intent to eventually adhere with DFARS compliance or as an unofficial, long term compliance deferment strategy.<\/p>\n
Instead, under the CMMC, contractors will begin being audited and evaluated based upon their implementation of their respective level\u2019s mandate controls. This can include but is not limited to formulating detailed IT policies, generating comprehensive network documentation and for the higher CMMC levels, the performance of annual penetration tests, to validate their adherence to compliance and verify their CUI\u2019s security posture.<\/p>\n
Most organizations will likely be required to adhere to CMMC levels 1 or 3, but regardless of the CMMC level you are required to attain, your certification level and adherence to it, will determine the types of contracts you will be qualified to acquire.<\/p>\n
- \n
- \n
Who Needs CMMC Compliance?<\/strong><\/h3>\n<\/li>\n<\/ul>\n
It\u2019s essential to reiterate that this CMMC level requirement will flow down to ALL subcontractors, prime and subcontractors alike, that are a part of the DoD supply chain. According to Katie Arrington, CISO for Acquisition under the Office of the Under-Secretary of Defense of Acquisition and Sustainment, only about 5% of contractors that will require CMMC are currently compliant, meaning that there is certainly a lot of work to be done to that end.<\/p>\n
As the Secretary of Defense has also stated, future RFPs will require a CMMC designation if you handle Controlled Unclassified Information (CUI)- period. All of this means that the CMMC is something you need to start thinking about as it is will become the standard framework for working with the DoD and any other government or federal agencies in the near future- including the GSA.<\/p>\n
The Department of Defense began finalizing the CMMC certifier accreditation program in January 2020, with the accreditation process itself expected starting in June. Based on this timeline, it\u2019s likely that we will see the first accreditations go out in the second half of 2020 with contractor evaluations -meaning the ones you have to care about- beginning now or shortly thereafter.<\/p>\n
- \n
- \n
CMMC Audit and Compliance<\/strong><\/h3>\n<\/li>\n<\/ul>\n
A dedicated team of auditors will be conducting these CMMC audits, but it is unclear how they will select the contractors that will be reviewed. If the costs of implementing these controls has you concerned, one important change moving forward will be the opportunity to recover, from the prime contractor, the expense of these solutions\u00a0as an \u2018allowable cost\u2019.<\/p>\n
This presents an interesting opportunity to not only introduce increased rates, but also new bidding strategies that leverage your CMMC posture as a true competitive advantage over your historical competitors that delayed the implementation of these similar compliance measures.<\/p>\n
Because these numerous compliance controls present a considerable cost to any organization, we encourage that you weigh the benefits of attaining CMMC alongside their associated costs to determine if any missed contract opportunities are worth the trouble of implementing these compliance requirements.<\/p>\n
If the costs outweigh the potential benefit or if you don\u2019t have the financials to hire additional IT security\/compliance professionals, you may want to consider cutting your losses or outsourcing your compliance needs to a reputable managed services provider or managed security services provider.<\/p>\n
The CMMC versus NIST<\/strong><\/h2>\n
- \n
- \n
What Is NIST?<\/strong><\/h3>\n<\/li>\n<\/ul>\n
The NIST 800-171 was established on January 1, 2018 and was created by the DoD to improve the low rate of NIST 800-171 compliance across the DIB<\/strong>.<\/p>\n
When NIST 800-171 was initially launched, the DoD did not accept third-party audits to verify both primes and sub contractors\u2019 adherence to these requirements which is why the CMMC was created. The CMMC was brought into effect to implement a systematic approach to audit contractor compliance with NIST SP 800-171 by requiring five varying levels of maturity expectations which range in the number of requirements and controls that must be met in order to achieve certification.<\/p>\n
- \n
- \n
Key Differences between CMMC and NIST<\/strong><\/h3>\n<\/li>\n<\/ul>\n
> Click here to see our detailed chart of the CMMC vs NIST<\/a><\/p><\/blockquote>\n
CMMC Level 1 versus CMMC Level 3<\/strong><\/h2>\n
Based on our research, it is our understanding that the most required CMMC levels will be either CMMC 1 or 3. The requirements within each vary considerably so we\u2019ve outlined the principal differences between the two.<\/p>\n
>> Click here to view TSI\u2019S CMMC Technical Managed Programs<\/a><\/p>\n
- \n
- \n
CMMC Level 1<\/strong><\/h3>\n<\/li>\n<\/ul>\n
Level 1 or \u201cbasic cybersecurity hygiene\u201d is the minimal level of security controls that a government contractor must establish to get the Cybersecurity Maturity Model Certification. Only the basic security controls, such as such as using antivirus software or ensuring employees change passwords, need to be in place to qualify for this level.<\/p>\n
Level 1 is the basis upon which the other levels are built. Once the basic security controls are in place, you will be able to safeguard FCI and keep it away from public viewing. Similarly to CMMC 3, this level has 17 practice areas, which are derived from FAR (Federal Acquisition Regulation 48 CFR 52.204- 21<\/a>).<\/p>\n
- \n
- \n
CMMC Level 3<\/strong><\/h3>\n<\/li>\n<\/ul>\n
This level builds on the basic Level 1 and Level 2 CMMC requirements. Contractors that have achieved Level 3 are equipped with the basic security controls needed to protect sensitive and confidential data and denotes that the contractor has facilitated 130 cybersecurity practices.<\/p>\n
These practices are derived from FAR and also include all the practices listed in NIST SP 800-171<\/a>, as well as 20 other practices. They help implement \u201cgood cyber hygiene\u201d practices to safeguard CUI.<\/p>\n
Implementing CMMC Controls Cost Effectively<\/strong><\/h2>\n
- \n
- \n
The Assessment Phase<\/strong><\/h3>\n<\/li>\n<\/ul>\n
The first step toward CMMC compliance starts with the assessment phase where you establish a baseline for recommendations that will address any gaps that may impact your CMMC compliance posture. Based on the actionable insights stemming from this assessment, you can start formulating a strategic roadmap addressing these gaps and ultimately move onto the implementation of those controls in preparation of any audit or vendor driven compliance verification request.<\/p>\n
This assessment should clearly determine your compliance posture alongside all the required steps and resources to address them. It\u2019s important to also note that because the documentation attesting the completion of these controls is a CMMC requirement, you should do so to also help guide your efforts to make sure you\u2019re paying the appropriate amount of attention to the most heavily weighted compliance requirements of the CMMC.<\/p>\n
- \n
- \n
Plan of Action and Milestones (POA&M)<\/strong><\/h3>\n<\/li>\n<\/ul>\n
The good news is that getting ready for CMMC certification isn\u2019t necessarily difficult IF there is a precise, regimented plan in place addressing your strategic gaps alongside a solid understanding of how to minimize the exposure of CUI throughout your organization.<\/p>\n
At the very least, you can accomplish this by making sure that the parts of your network that are accessing CUI are segregated from the broader network.<\/p>\n
Minimizing your \u2018exposure\u2019 to CUI is one of the most critical ways that can significantly minimize your costs and achieve compliance in a way that is both complete and cost-effective.<\/p>\n
- \n
- \n
The Role of a Managed Services Provider<\/strong><\/h3>\n<\/li>\n<\/ul>\n
Rather than hiring your own CIO\/CISO to address your CMMC requirements ,you could also dramatically minimize the costs of attaining CMMC compliance by choosing to partner with a Managed Security Services Provider that is well oriented with these compliance requirements \u2013 something that we\u2019ve spoken to in a recently published article, \u2018vCISO for CMMC \u00a0\u2019. \u00a0<\/a>\u00a0Because approximately 95%+ of all CMMC certification requirements are cybersecurity related, working with an MSP or MSSP will provide the resources and expertise required for a successful compliance strategy.<\/p>\n
In addition to the ongoing management of your compliance strategy, your MSSP can also work with your auditors or clients to verify you adherence and ensure you\u2019re positioned for long term success, rather than investing in additional internal resources to accommodate to these IT requirements. Keep in mind that your CMMC success not only includes the successful implementation of IT solutions, but a clear understanding of what auditors are looking for. Don\u2019t make the mistake of delegating these compliance tasks to your IT team and seriously consider either sourcing or hiring a CIO\/CISO level resource to help accomplish your respective compliance objectives. There is a high degree of expertise required to successfully implement these controls and relying on a small IT team or network administrator is both unfair to them and your organization as a whole- even if they\u2019re insistent that they can accomplish this!<\/p>\n
To say that CMMC certification is a huge undertaking is a bit of an understatement, especially considering that you\u2019ll be required to constantly document and verify the security posture of the greater network as well as the end users accessing CUI.<\/p>\n
That said, if partnering with an MSSP is your likely route, keep in mind that you need to give your provider considerable time to get you to the point where you need to be. Generally speaking, it takes several months- at a minimum- to get everything into place and requires the ongoing documentation, testing and configurations of these solutions- in addition to your existing security processes- to address today\u2019s evolving cyber threats.<\/p>\n
If nothing else, remember that CMMC certification is NOT something you want to wait until the last minute to do. At the very least, you should perform an assessment as soon as you\u2019re able, to help forecast your expenses as well as provide the chance to identify the who\/what\/when\/where\u2019s of the process to clarify exactly what you need to do to become compliant so that it isn\u2019t a complete surprise to your company and any sales opportunities are unanticipatedly lost.<\/p>\n
Preparing for CMMC Certification, Together<\/strong><\/h2>\n
At TSI Support International, we understand how important CMMC certification is – and we’re also aware that this is one road you’re not necessarily eager to travel down alone. But the good news is that we\u2019ve been addressing these and similar compliance requirements for over 20 years, and confident we can help you as well. To learn more about how we can help your organization, feel free to contact either myself or a colleague at TSI to schedule your introductory phone call. That way, we can make sure you\u2019re best positioned to address these requirements and can focus on growing your business.<\/p>\n
<\/p>\n
<\/p>\n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
![\"CMMC-Certification-CTA\"](\"https:\/\/tsisupport.com\/tsistaging\/wp-content\/uploads\/2019\/11\/CMMC-Certification-CTA.png\" "\\"CMMC-Certification-CTA\\"")
\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/div>\n<\/div>