CMMC Breakdown

When you think of the federal government protecting our homeland, certain images and organizations come to mind. However, there is much more to national defense than you think. Malicious cyber activity significantly increases risks to national security, undercutting U.S. technical advantages and innovations in defense. This is why, in 2020, the Department of Defense (DoD) released the Cybersecurity Maturity Model Certification (CMMC) – the new standard for all DoD acquisitions. 

So, what is CMMC and why is it important for working with the government? We break it down for you below.

WHAT IS CMMC EXACTLY? 

Boiled down – the Department of Defense (DoD) will hold your cybersecurity process as foundational to winning contracts and how they do this is the Cybersecurity Maturity Model Certification (CMMC). CMMC version 1.0, released on January 31, 2020, introduced multiple maturity levels contractors could obtain,  ranging from “Basic Cybersecurity Hygiene” (Level 1) to “Advanced” (Level 5). In November 2021, the Department announced “CMMC 2.0,” updating the framework from 5 levels to just 3 levels.

This comprehensive program requires extensive knowledge. CMMC persistence is not a matter of organizational compliance, it is a matter of organizational change, and Alluvionic is a leader in organizational change management. 

WHO NEEDS CMMC? EVERYONE! YES, EVEN YOUR SUB-CONTRACTORS.

Whether you’re a large billion-dollar prime contractor or a single-scope small budget subcontractor, cybersecurity will have an impact on the way you conduct business. PLUS, prime contractors must pass along the CMMC requirements to all sub-contractors – all the way down the chain. That’s why it’s imperative prime contractors should be asking their sub‐contractors the following:

• Where do you stand regarding CMMC?
• Where do you need to be regarding CMMC?
• Do you anticipate being able to meet CMMC requirements?
• When will you be ready for Certification?

Prime contractors and subcontractors should also have contingency plans in place in case a contractor does not meet CMMC requirements or loses their CMMC certification.

If your Sub-Contractor has not completed a CMMC assessment, the time is now. Here is a more in-depth look at CMMC. 

GETTING YOUR CMMC CERTIFICATION

CMMC is not just a measure – but a certification. The CMMC compliance model is built on the NIST SP 800-171 framework consisting of 14 security domains and 110 controls. The foundational level 1 controls require annual self attestation and the advanced level 2 controls require triennial third party assessment. Level 3 controls will be assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) the details of which are still in development. A certification will require a compliance assessment by an independent and sanctioned third‐party auditor. It is critical that you understand where you fall in order to bid on contracts. 

Achieving CMMC compliance is a lot more involved than simply adding new security functions to your business’s network – it also involves implementing a series of specific cultural behaviors, policies, and practices within your business. Here is more on what you need to know to achieve your CMMC compliance. If you want more information on the Revision 3 Draft, check out this article here.

ALLUVIONIC HELPS YOU CONQUER YOUR CYBERSECURITY CERTIFICATIONS 

Leveraging a proven disciplined process and team management, Alluvionic can help you assess your cyber-resilience and build a comprehensive, strategic, and persistent risk management approach. Learn more here and contact our team today to start your CMMC process.