CMMC 

Understanding the CMMC Program

The Cybersecurity Maturity Model Certification (CMMC) program enhances cyber protection standards for companies in the Defense Industrial Base (DIB). It is designed to protect sensitive unclassified information shared by the Department of Defense (DoD) with its contractors and subcontractors. The program incorporates a set of cybersecurity requirements into acquisition programs and provides the DoD with increased assurance that contractors and subcontractors are meeting these requirements.

Key Features of the CMMC Framework:

1. Tiered Model:

   • CMMC requires companies entrusted with national security information to implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. The program also outlines the process for information flow down to subcontractors.

2. Assessment Requirement:

   • CMMC assessments allow the DoD to verify the implementation of clear cybersecurity standards.

3. Implementation through Contracts:

   • Once fully implemented, certain DoD contractors that handle sensitive unclassified DoD information will be required to achieve a specific CMMC level as a condition of contract award.

CMMC Compliance Requirements:

• All DoD contractors and subcontractors must implement practices and controls to safeguard Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

• DoD contractors and subcontractors must undergo an assessment by a CMMC Third-Party Assessment Organization (C3PAO).

What can you be doing right now? 

Organizations across the defense industrial base are rigorously examining their controls related to NIST 800-171 and understanding the differences between NIST 800-171 and CMMC. Here are some specific areas of focus for DoD contractors:

1. Define Your CUI Boundary:

   • To determine the appropriate CMMC level, start by understanding your Controlled Unclassified Information (CUI) boundary and the types of information that flow through your environment.

2. Revisit Your System Security Plan (SSP):

   • Under previous DFARS clauses, DoD contractors were required to develop and maintain an SSP. Now is an ideal time to review and update your SSP, as it will be a crucial part of your CMMC assessment.

3. Review Your POA&M:

   • If you’ve performed a self-assessment, you should have developed a Plan of Action and Milestones (POA&M) that outlines gaps and plans to address them. Before your CMMC assessment, strive to close any outstanding gaps by reviewing and updating your POA&M.