CMMC

What is CMMC?

CMMC stands for “Cybersecurity Maturity Model Certification” and encompasses 5 maturity levels that range from “Basic Cybersecurity Hygiene” to “Advanced”. The intent is to identify the required CMMC level in RFP sections L and M and use as a “go / no go decision.” DOD is planning to migrate to the new CMMC framework in order to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC is intended to serve as a verification mechanism to ensure appropriate levels of cybersecurity controls and processes are adequate and in place to protect controlled unclassified information (CUI) that resides on the Department’s industry partners’ networks.

How can my company obtain CMMC certification?

Your company will engage directly with an accredited and independent third party commercial certification organization to request and schedule your CMMC assessment. Currently there are no companies accredited but the CMMC Accrediting Body is working with companies to provide a means for overall certification of 3rd party organization. (https://www.cmmcab.org/) Your company’s DoD contracts will specify the level of the certification required based on your company’s governmental requirements for safeguarding information on your company’s site. Your company will be awarded certification at the appropriate CMMC level upon demonstrating the appropriate maturity in capabilities and organizational maturity to the satisfaction of the assessor and certifier.

The 5 CMMC Maturity Levels:

Level 1

Process: At this level, practices are performed in an ad-hoc manner so there is no process requirement.
Practice: It addresses protection of FCI and 17 practices are required for the basic safeguarding requirements specified in 48 CFR 52.204.21.

Level 2

Process: Policy and documentation of practice are required to develop mature capabilities and achieve process Level 2.
Practice: Progression from Level 2 to Level 3. The majority of practices (65 of 72) comes from NIST SP 800-171 and new 7 practices from other standards are added to Level 2, such as audit log review, event detection/reporting, analyzing triaging events, incident response, Incident RCA (root cause analysis), regular data backup and testing, and encrypted session for device management.

Level 3

Process: Not just policy and documentation of practices, a plan is required to demonstrate management of practice implementation activities. The plan needs to address missions, goals, project plans, resourcing, required training and involvement of stakeholders.
Practice: All 110 control requirements of NIST SP 800-171 are required for this level. In addition, 13 new practices from other standards are added to Level 3, such as defining procedures of CUI data handling, collecting audit info into central repositories, regular data backups, periodical risk assessment, risk mitigation plan, separate management of non-vendor-supported products, security assessment of enterprise software, cyber threat intel response plan, DNS filtering, restriction of CUI publication, spam protection mechanisms, email forgery protections, and sandboxing.

Level 4

Process: Practices are reviewed and measured for effectiveness. In addition, correct actions when necessary and communication to higher level mgmt. on a recurring basis are required.
Practice: In order to protect CUI from APTs, 26 practices enhance the detection and response capabilities to address and adapt to TTPs used by APTs.

Level 5

Process: Process standardization and optimization.
Practice: The additional 15 practices increase the depth and sophistication of cybersecurity capabilities.

Understanding CMMC: How it will affect your organization and how to prepare.