What is the Cybersecurity Maturity Model Certification (CMMC) and Why is it Important for DoD Partners?
The Cybersecurity Maturity Model Certification (CMMC) is used by US Department of Defense (DoD) partners to safeguard sensitive unclassified information. DoD contracts require that partners have achieved a particular CMMC level as a condition of contract award. Once you achieve CMMC certification at the necessary level, you can pursue those contracts!
What Are the Different Levels of the CMMC?
CMMC has a tiered model with progressively advanced levels, with the required level depending on the type and sensitivity of the information. These tiers are:
- Level 1 (foundational) is required for safeguarding federal contract information, and is the easiest to achieve with only 15 requirements and an annual self-assessment.
- Level 2 (advanced) is required for safeguarding controlled unclassified information (CUI), and includes a total of 110 requirements from NIST SP 800-171. Some companies are authorized to demonstrate compliance through self-assessment, but most will require a third-party assessment every three years.
- Level 3 (expert) is rarely required, and builds on level 2 to include some additional requirements based on the sensitivity of the information, from NIST SP 800-172.
4 Steps to Streamline CMMC Compliance
It can be challenging to prioritize everything when your team is already focused on other major efforts. If compliance is a concern, here are four steps you can follow to streamline the process and manage it effectively.
1. Identify Gaps and Plan Necessary Changes
Start by reviewing your technical controls, policies, and processes to identify gaps in relation to the compliance requirements for your desired level. This assessment will help you understand where you stand and what changes need to be made to meet the required standards.
2. Engineering to Remediate Gaps
Collaborate with your engineering team to implement the necessary changes for compliance. The goal is to address any identified gaps efficiently, ensuring your systems and processes align with the required regulations.
3. Prepare Self-Assessment Documentation
Document your findings and progress throughout the process. Update your initial gap assessment to reflect any changes made during the engineering phase, ensuring that your self-assessment demonstrates full compliance.
4. Coordinate with Auditors (For Level 2+ Requirements)
If a third-party assessment is required, ensure you are prepared to coordinate with an authorized auditor. This can help demonstrate how your organization meets the necessary requirements while minimizing the impact on internal teams.
What to Expect During a CMMC Gap Assessment
As the first step in the compliance process is a gap assessment, knowing what to expect is helpful.
A detailed evaluation of your cybersecurity controls will be conducted according to the applicable requirements. This includes reviewing documentation, interviewing control owners and other stakeholders, and evaluating the effectiveness of your controls. The goal is to identify the gaps between your current practices and the CMMC requirements and to recommend specific changes to address these gaps.
In many cases, the effort required to address most gaps is less than expected. Some organizations may even be able to start addressing identified issues before the assessment is complete.
If you are using cloud service providers, you may be able to inherit some of their controls, making compliance easier and faster. This can reduce the total number of practices you are responsible for, potentially lowering the count from 110 to approximately 79.
Another common issue is when necessary controls are in place but the documentation is outdated or incomplete, leading to insufficient evidence of compliance. By updating or developing this documentation, you can quickly provide the required evidence to meet CMMC standards.
How much will CMMC cost?
The DoD estimates the following CMMC costs for each maturity level:
- Level 1 self-assessment with affirmation: ~$1,000 to ~$6,000
- Level 2 self-assessment with affirmation: ~$37,000 to ~$49,000
- Level 2 third-party assessment: ~$105,000 to ~$118,000
- Level 3 safeguard implementation and third-party assessment: ~$490,000 to ~$21.1M
How Can ScaleSec Help?
Security remains the top concern as the cloud grows in popularity. ScaleSec was founded to address this concern, guiding customers through stringent compliance requirements using the cloud securely through strategic advisory services, implementation assistance, and ongoing education. As a service-disabled, veteran-owned small business (SDVOSB) for cloud security and compliance, our team of experts guide customers through complex cloud security challenges. Our customers rely on us to work side-by-side with their teams to demonstrate cloud security, scale their operations, and decrease risk.
If you need help navigating cloud security and compliance challenges, contact ScaleSec to discuss how our team of experts can support your organization.
References:
- Department of Defense Chief Information Officer. About CMMC.
- Amazon Web Services. Cybersecurity Maturity Model Certification (CMMC).
- Microsoft. Cybersecurity Maturity Model Certification (CMMC).
- Google Cloud. U.S. Cybersecurity Maturity Model Certification (CMMC).
- National Defense Magazine. CMMC Certification Cost: The Price of Compliance.
- Defense Scoop. Pentagon reveals updated cost estimates for CMMC implementation.