In a growing IT market, there is an even greater need for cybersecurity. The Department of Defense (DoD) is implementing new changes to policies related to contractors.

The Cybersecurity Maturity Model Certification (CMMC) is a new program from the DoD to verify contractors are protecting their Controlled Unclassified Information (CUI). The CMMC site states, CUI is information that a law, regulation, or Government-wide policy requires an agency to handle using safeguarding or dissemination controls. Examples of CUI include data related to NATO, financial, defense, critical infrastructure, and more.

While this only applies to contractors handling CUI materials, this standard will likely become common within the cybersecurity industry. The CMMC requires a third party to assess whether your contract meets cybersecurity criteria rather than the current "self-attest" model. The CMMC aims to provide accountability among DoD contractors in the way they handle data. 

CMMC is still essential to individuals who do not handle CUI because it will soon become standard within the cybersecurity industry. Third-party auditing of data control and security protects consumers and businesses from data breaches and leakage. With the number of data breaches that happen year to year, it is important to make sure that your organization is not at fault for leaking valuable information to the wrong hands. This article will discuss the five levels of CMMC compliance, tips to become compliant, information about consultants, and more. If you are working contracts with the DoD, we suggest you read ahead to learn more about this crucial new system in place for contractors.

To understand the CMMC process it is vital to understand the five levels defined within the process. The lower the level, the easier it is to achieve. 

1. Performed - This involves the practice of basic cyber hygiene. This is the lowest level and often does not rely on documentation for verification. This consists of the performance of 17 cybersecurity practices, and documentation is optional. This level has little maturity because there is typically little to no documentation to ensure compliance.
2. Documented - This includes the practice of intermediate cyber hygiene. Documentation is required at this level, and there are policies in place per the CMMC publishings. This allows for maturity because documentation is created and can be audited and documented. All and all, at level 2, firms must perform and document 72 practices related to cybersecurity.
3. Managed - The practice of good cyber hygiene includes 130 practices managed and documented by a third party. This level of compliance goes a long way in protecting valuable data. This also allows for the maturity of processes because a third party is monitoring and supervising the data. While this is secure and allows third parties to protect the data, it is important to understand the difference between the further levels that better protect data.
4. Reviewed - This practice involves proactive cyber hygiene and examines the effectiveness of the organization’s practices. This process includes 156 practices that are performed, documented, managed, and reviewed for effectiveness. While this is a very effective process and proactively protects data, the next level of CMMC compliance will further optimize the process. 
5. Optimizing - This is the most advanced cyber hygiene standard and involves 171 practices performed, documented, managed, reviewed, and optimized for effectiveness.  This is the highest level of CMMC and keeps things secure and clean. Level five is the most effective and secure process related to controlling CUI data. 

It is essential to understand the difference between the levels of CMMC because your organization will need to be compliant with the stringent requirements of the new system. In addition, it is crucial to understand that these requirements build on top of each other. If you are level 3 compliant, you are also compliant in levels 1 and 2. It is essential to understand the required CMMC level for the particular contract you are bidding on.  

If you bid on a project above your organization's CMMC compliance, you can be instantly denied. This can harm your organization because you rely on DoD contracts for income to pay vendors and employees.

Top Three Things To Know About CMMC

CMMC compliance is a new system to hold the cybersecurity industry accountable for CUI. We will discuss three of the most important things to know about the new CMMC system and what you should keep in mind when making sure your firm is compliant. If your firm does not get compliant, it can prevent you from applying for DoD contracts. There are currently over 300,000 companies registered with the Defense Industrial Base (DIB).  If your company is registered on the DIB, these tips apply to you: 

1. If you have a current DoD contract that involves CUI, you need to be level 1 compliant at a minimum. Even without a DoD contract, you should care about CMMC compliance because it will affect the entire cybersecurity industry. It is crucial to have a robust cybersecurity defense to protect your business and customers. Following the CMMC guidelines will ensure that when they become industry standard, your company is ready.
2. You cannot reach compliance alone. Before CMMC, the standard was self-assessment in cyber readiness. Now, with the CMMC standards, an accredited CMMC 3rd Party Assessor Organization (C3PAOs) will be required when assessing contractors on behalf of the DoD. The DoD contractors will have to pay the C3PAOs for their services. This will include an inspection of systems and operations for compliance.
3. Be proactive and do not wait; compliance takes time. Several elements go into CMMC compliance. Among them include writing policies, deploying solutions, and instituting the necessary culture to ensure company-wide compliance. Self-assessments and audits are a great way to review and make sure employees comply internally.

Becoming CMMC certified will be obtained through a third-party auditor who will review the systems and infrastructure in place of the organization. It is crucial to implement the CMMC compliance within your organization structure to win more DoD contracts. 

Should I Hire A CMMC Consultant?

The short answer is yes. If you work with CUI and plan to continue, you must be CMMC compliant. This process is not easy and should not be taken lightly.  Before paying money to a C3PAO, we recommend contacting a CMMC consultant to ensure your firm is ready.  The process to get certified through a C3PAO is costly, but failing the first audit and can even prevent you from getting specific future contracts.  Working with a CMMC consultant is what we refer to as a dry run.  The consultant will run your firm through the same stringent examination of systems and processes that a C3PAO will do at the official evaluation time.  In addition, they will offer detailed insight on the improvements and changes that need to be made before moving forward with scheduling a certification from a C3PAO.

A CMMC consultant should also be contacted if a firm is interested in increasing its level of compliance.  Increasing the level of CMMC compliance can be just as tricky as applying and getting approved in the first place.  This process is made to prevent firms from mishandling data and enables third-party accountability for the cybersecurity industry. A CMMC consultant will have a mastery of knowledge on each level and the practices required to be compliant.

NIST 800-171’s Importance In CMMC

If you are unfamiliar with NIST 800-171, it is the codification of requirements required regarding the confidentiality of CUI on a non-government computer system. CMMC and NIST 800-171 go hand in hand. NIST 800-171 focuses on protecting CUI where it is stored and processed, whereas CMMC focuses on CUI controls and functions relevant to its use.

It is essential to understand that just because you are CMMC compliant does not mean you are compliant with NIST 800-171 standards.  The same goes for the opposite. NIST 800-171 compliance does not mean CMMC compliance.

So What Should You Do? 

If you are not CMMC compliant, the first thing you should do is check your current contracts with the DoD to ensure your contract will not require it at the time of renewal. Even if not previously required, CMMC is a new standard and will need contractors working within cybersecurity to become compliant. This change will take time, and you should be ahead of the curve instead of being behind when the regulations get stricter and become required industry standards. 

If you are handling CUI or plan to bid for a contract in the future that involves this data, you must be prepared. We suggest understanding the difference between the levels of CMMC compliance in great detail.  We briefly covered the five levels that are performed, documented, managed, reviewed, and optimized. It is vital to understand what level of compliance is required for your DoD contract. 

We suggest working with a CMMC compliance consultant to help your organization prepare for the official evaluation of a C3PAO firm. This will ensure that your firm is prepared and that your organization’s staff clearly understands the new standard within the cybersecurity industry.

_______

Article provided by Edge Networks an Information Technology & Services company based out of Vancouver, Washington. Edge Networks handles all-things IT so you can work happy.

If you are interested in learning more about the funding and support Impact Washington has for cybersecurity and CMMC programs - fill out our cybersecurity interest form