What the CMMC standard means for your organization

The frequent targeting of federal suppliers provided the impetus for the creation of the CMMC standard, which the DoD implemented on Jan. 31, 2020. It requires organizations that handle or process controlled unclassified information (CUI) and federal contract information (FCI) to become certified by demonstrating a specified level of maturity regarding the information security program and associated controls.

Certification is performed by an accredited CMMC Third Party Assessor Organization (C3PAO) on a pass-fail basis. These C3PAOs are accredited by the CMMC Accreditation Body (CMMC-AB) to ensure that the professionals conducting CMMC assessments have the appropriate training and knowledge to evaluate an organization’s compliance against CMMC criteria. The enforcement of the CMMC is carried out through the request for proposal (RFP) and request for information (RFI) processes, which require certification at a designated level in order to submit a response to specific RFPs and RFIs.

Maturity in the CMMC model

The CMMC framework includes five levels of maturity, and each increasing level incorporates all previous levels’ controls within the framework. While the required level of maturity has not yet been defined, speculation is that organizations handling FCI will require Level 1 or 2 certification, while those handling CUI will be required to achieve at least a Level 3.

The maturity levels and associated requirements are informed by the Federal Acquisition Regulation (FAR), the National Institute of Standards and Technology (NIST), and other organizations’ frameworks, including:

• FAR 48 CFR 52.204-21
• NIST SP 800-171 Rev. 2
• NIST SP 800-172
• NIST SP 800-53 Rev. 5
• ISO/IEC 27002:2013
• U.S. CERT-RMM Version 1.2
• CIS Controls V7.1

The following table lists the major controls and frameworks for each maturity level:

CMMC maturity and controls

Organizations should keep in mind some important considerations when examining these various frameworks. For example, while the majority of the controls from Levels 1 through 3 are taken straight from NIST 800-171 Rev. 2, compliance with the CMMC does not inherently mean compliance with NIST SP 800-171, as many organizations incorrectly assume.

Although Level 3 does contain all CUI controls within NIST SP 800-171, the CMMC does not contain the 63 nonfederal organization (NFO) controls listed within Appendix E of NIST SP 800-171. However, compliance with all controls (including those NFO controls in Appendix E) in NIST SP 800-171 is required of DoD contractors; otherwise, they can be subject to penalties under the False Claims Act.

A closer look at CMMC standard controls

The CMMC model has 17 domains, and each domain has a set of controls and capabilities that is attributable across the five maturity levels. Currently, Level 5 criteria include more than 170 controls across these 17 domains. The domains are listed here:

Achieving CMMC standard compliance

Organizations that seek to achieve CMMC compliance typically follow a phased approach, which includes:

• Understanding the scope. The first step in a CMMC compliance journey begins with understanding the type of CUI and FCI the organization is handling, as well as all of the locations, assets (systems), and personnel that contain or access CUI/FCI data that would be considered in scope for a certification.
• Considering CMMC architecture and strategy. If access to CUI/FCI data is not a pervasive requirement within the organization, the organization can create a strategy to segregate the CMMC-related data in order to minimize the scope for the review and certification process.
• Performing a self-assessment. Many organizations prefer to perform a precertification gap analysis, particularly if they are targeting Level 3 maturity or higher. This self-assessment can provide an understanding of the gaps that will need to be remediated in order to achieve the desired level of certification.
• Closing the gaps. Depending on the number and complexity of the gaps noted in the initial assessment, organizations should develop a plan of action to address the identified gaps prior to pursuing certification. Timelines for remediation will vary depending on the nature of the gaps identified as well as on resources available to assist.
• Taking the official test. Once all gaps are remediated, the organization is ready for the certification assessment. The CMMC-AB Marketplace includes an inventory of the firms that are approved to perform a CMMC certification assessment.

The future of the CMMC standard

Currently, details regarding the CMMC standard are still being finalized, including the designation of registered provider organizations and C3PAOs in the CMMC-AB Marketplace. Reportedly, the DoD is planning to issue only 15 contracts this year that will require any level of CMMC certification.

The DIB consists of hundreds of thousands of organizations that will require some of level of certification over the next five years. Some of those institutions might end up needing multiple certifications for different networks, systems, or segments. As such, many more accredited assessors that are capable of evaluating organizational practices related to the CMMC standards will be needed.

It’s unclear if and when the CMMC will expand to additional entities, but certified assessors who can assist with the CMMC program are in high demand. While these details are being finalized, it’s important that organizations that will need to be CMMC compliant in the future take the opportunity now to perform assessments in order to be prepared for certification.