What is CMMC Compliance?

Corserva blog

The Cybersecurity Maturity Model Certification (CMMC) was created to enhance the cybersecurity posture of companies participating in US government supply chains. As of December 31, 2017, defense and government suppliers had to comply with NIST 800-171. Starting in 2020 with the introduction of the CMMC FAR clause, the DoD is gradually transitioning federal contract information to include CMMC instead of NIST 800-171.

NIST 800-171 Versus CMMC 2.0

There are two significant differences between NIST 800-171 and CMMC:

  • CMMC includes three different levels.
  • Unlike NIST 800-171 where compliance is done through self-attestation, with CMMC, some companies will need an outside assessment (depending on the CMMC level to which they need to comply).

 

CMMC - A New Cybersecurity Standard

The Cybersecurity Maturity Model Certification (CMMC) is a unified cybersecurity standard created to increase the security posture of companies operating in government supply chains. Version 1.0 was released in January 2020, and a minor update to Version 1.02 in March 2020. CMMC 2.0 was announced in November 2021.

CMMC is to be rolled out gradually and will eventually replace NIST 800-171 compliance.

 

Once CMMC 2.0 rulemaking is complete, the Department of Defense can begin to include CMMC requirements in RFPs.

By October 1, 2025, all new DoD contracts will require CMMC.

 

cmmc-timeline-3

 

You can learn more about CMMC at these government sites:

Request a Quote for CMMC Consulting Services

 

Changes to Self-Attestation

Depending on the CMMC level to which you must comply, you may need to work with an accredited and independent third-party organization to perform a CMMC assessment. Or you may be able to self-attest to CMMC compliance.

 

CMMC Levels

The CMMC framework contains 3 maturity levels. The CMMC practices provide a range of mitigation across the levels, starting with basic safeguarding and basic cybersecurity at Level 1, moving to the broad protection of CUI at Level 2, and culminating with reducing the risk from Advanced Persistent Threats (APT) at Level 3.

DoD contracts stipulate to which level (1, 2, or 3) a supplier must meet.

  • CMMC Level 1, Foundational, 17 cybersecurity practices
  • CMMC Level 2, Advanced, 110 practices (equivalent to NIST SP 800-171)
  • CMMC Level 3, Expert, over 110 practices (subset of NIST SP 800-172)

 

Self-assessments are performed annually. Outside assessments are performed every 3 years.

 

CMMC

 

A subcontractor working for a prime contractor may not necessarily need to meet the same level as the prime. For example, to win a contract, first-tier DoD contractors may need to be at Level 2 but a supplier to a prime may only need to be at Level 1 if that supplier will never receive or touch information that needs to be protected.

Many small businesses will only need to meet Level 1.

 

How to Comply with CMMC

There are three different ways to become CMMC compliant, depending on the level you need to meet:

  1. Self-attestation - Level 1 CMMC companies can self-attest to compliance, as well as some Level 2 CMMC companies.
  2. C3PAO assessment - Level 2 CMMC companies that are not eligible for self-attestation are assessed by an accredited and independent third-party organization called a "CMMC Third Party Assessment Organization" or C3PAO. A C3PAO is trained in accredited to perform CMMC assessments.
  3. Government-led assessment - Level 3 CMMC companies undergo a government-led assessment, which is expected to also include a C3PAO assessment as part of the process.

 

The major distinction in CMMC certification is whether you are protecting Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

  • Level 1 CMMC companies protecting only FCI are eligible for self-attestation to CMMC.
  • Level 2 CMMC companies protecting CUI in the course of non-prioritized acquisitions can self-attest.
  • Level 2 CMMC companies protecting CUI in the course of prioritized acquisitions require a C3PAO assessment.
  • Level 3 CMMC companies protecting CUI in the highest priority programs require a government-led assessment.

 

NIST and CMMC

 

CMMC Compliance Process

The first step in the CMMC compliance process is to determine the level of CMMC you want to meet (based on future contracts on which you plan to bid and internal business goals).

 

CMMC Compliance Through Self-Attestation

Level 1 CMMC companies and Level 2 CMMC companies that are eligible for self-attestation undergo the following process to achieve CMMC compliance.

  1. Prepare internally to meet the selected standard. Identify gaps in your processes and systems. You can leverage the services of a CMMC-AB Registered Provider Organization™ (RPO) listed in the CMMC-AB Marketplace to help you.
  2. Perform remediation to fix any gaps.
  3. After remediation, a senior official from your company (CEO, CFO, etc.) uploads the assessment into the DoD Supplier Performance Risk System (SPRS).  

Corserva can assess your compliance to the 17 controls and guide you in submitting your assessment results to the government.

The self-assessment is performed annually to stay in compliance with CMMC.

 

CMMC Compliance Through a C3PAO Assessment

Level 2 CMMC companies requiring a C3PAO assessment undergo the following process to achieve CMMC compliance.

  1. Prepare internally to meet the selected standard. Identify gaps in your processes and systems. You can leverage the services of a CMMC-AB Registered Provider Organization™ (RPO) listed in the CMMC-AB Marketplace to help you.
  2. Perform remediation to fix any gaps.
  3. After remediation, select a C3PAO from the CMMC Accreditation Body Marketplace and engage them to provide the assessment.
  4. After the C3PAO performs the assessment, the C3PAO submits the assessment for review by the CMMC-AB.
  5. CMMC certification is issued to your company.

The certification will last for 3 years, at which point companies will be able to renew their certification.

 

The Overlap of NIST 800-171 and CMMC

CMMCBecause CMMC is to be rolled out gradually, there will be a period where both NIST 800-171 and CMMC will be in effect. By October 1, 2025, all new DoD contracts will include CMMC cybersecurity requirements.

Suppliers working under multiple contracts may be complying with NIST 800-171 on some contracts and CMMC on others. Level 2 of CMMC is equivalent to NIST 800-171.

 

CMMC Impact to Current Contracts

No existing contracts will have CMMC requirements inserted into them. The potential for CMMC requirements is only with new future contracts.

The certification to win a contract will be needed at the time of the award.

 

CMMC Requirements

You should think of NIST 800-171 as the foundation for CMMC.

There are 14 families of requirements in NIST 800-171 and across the 14 families are a total of 110 individual requirements.

The CMMC model consists of 14 domains that align with the families specified in NIST SP 800-171.

cmmc-levels

NIST 800-171 was about compliance whereas CMMC is about reducing risk in DoD supply chains. What hasn't changed is the goal: to protect information.

 

RPOGet Ready for CMMC Now

As a CMMC-AB Registered Provider Organization™ (RPO) listed in the CMMC-AB Marketplace, Corserva can help prepare companies to get ready for a CMMC assessment or to self-attest. 

Corserva offers an easy process for your organization to comply with CMMC. Request a quote today to protect your government contracts and prevent cyber threats.

Request a Quote for CMMC Consulting Services

 

Post Date: May 14, 2020 // 10:43 AM

Topic category:

NIST & CMMC

Author:

Lisa DeVoto

Lisa has 25+ years of experience working for technology companies in B2B marketing and technical communications. She is driven to help people solve problems through educational content. Lisa has an MBA from University of Connecticut and a BS in Computer Science from Rensselaer Polytechnic Institute.

Share:

   

SUBSCRIBE TO RECEIVE BLOG POSTS

RECENT POSTS

POSTS BY TOPIC

POSTS BY DATE