The Cybersecurity Maturity Model Certification (CMMC) is a new certification model designed to verify that DoD contractors have sufficient controls to safeguard sensitive data, including Confidential Unclassified Information (CUI) and Federal Contract Information. 

Created by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)), CMMC is a consolidated cybersecurity standard that’s mandatory for everyone doing business with the DoD. It brings together existing cybersecurity control requirements, such as ISO 27001, ISO 27032, NIST SP 800-171, and NIST SP 800-53, to create more detailed and coordinated cybersecurity standards. 

Unlike previous security standards that only called for self-verification in order to achieve compliance, CMMC requires a third-party assessment from a certified auditor.

In 2015, the Department of Defense (DoD) published the Defense Federal Acquisition Regulation Supplement (DFARS) to push private contractors to maintain cybersecurity standards according to the requirements the National Institute of Standards and Technology (NIST) outlined in NIST SP 800-171.

Created to ensure the protection of Confidential Unclassified Information (CUI), the standards outlined in DFARS and NIST 800-171 gave DoD contractors until December 31, 2017 to meet the requirements necessary to be compliant or risk losing DoD contracts. 

To be classified as compliant, contractors merely had to attest to meeting the requirements or being in the process of satisfying them.

Unfortunately, self-verification was inadequate and didn’t provide a level of security that could consistently safeguard sensitive information. While some contractors complied with the requirement, others failed to meet the standards. 

As a result, U.S. adversaries have been able to develop military equipment based on stolen data. For instance, the Chinese J-20 and J-31 stealth fighter jets suspiciously resemble the American F-35. According to the Pentagon, China may have accessed the F-35 design after an information breach in 2009.

Verified Compliance

Compliance without accreditation doesn’t guarantee absolute security. After reviewing the NIST security controls, the DoD decided they don’t sufficiently cover security loopholes, leaving contractors susceptible to threats from malicious actors. 

CMMC was devised to help:

1. Eliminate cyber vulnerabilities within the supply chain by verifying DoD contractors have appropriate cybersecurity controls in place via mandatory certification. 
2. Protect CUI residing in the networks of DoD vendors.

In addition, certification will not be one and done. It will be ongoing, and CMMC certification will have to be renewed every three years.

Released in January 2020, version 1.0 of the CMMC lays out the framework. It includes 17 domains that are based on cybersecurity best practices. Each domain is broken down into practices and processes that are mapped across five maturity levels. Within each domain, the practices are aligned to a set of capabilities. 

The 17 CMMC Domains

The CMMC model consists of 17 domains, 14 of which are derived from the Federal Information Processing Standards (FIPS) Publication 200 and NIST 800-171, and three additional domains.

1. Access Control (AC)
2. Identification and Authentication (IA)
3. Physical Protection (PE)
4. Asset Management (AM)
5. Incident Response (IR)
6. Recovery (RE)
7. Audit and Accountability (AU)
8. Maintenance (MA)
9. Risk Management (RM)
10. Awareness and Training (AT)
11. Media Protection (MP)
12. Security Assessment (CA)
13. Configuration Management (CM)
14. Personnel Security (PS)
15. Situational Awareness (SA)
16. System and Communications Protection (SC)
17. System and Information Integrity (SI)

5 CMMC Levels: Processes and Practices

The CMMC acknowledges that not all information shares the same levels of sensitivity, and not all contact participants have the same clearance levels. Because of this, the Cybersecurity Maturity Model Certification measures processes and practices across five maturity levels.

The achievement of higher CMMC levels enhances the ability of an organization to protect CUI. For Levels 4-5, it also reduces the risk of advanced persistent threats (APTs), which are often executed via multiple incursions, including cyber, physical, and deception.

Here is a synopsis of the five CMMC levels and their respective requirements:

Levels 1 and 2 involve basic cyber hygiene that most companies usually implement. Level 3 corresponds to the DoD cybersecurity requirements outlined in DFARS Clause 252.204-7012, which follows NIST SP 800-171 with an additional 21 controls.

According to the government, the requirements for Levels 4 and 5 match the standards of NIST SP 800-171 Rev B. Most of the controls conform with information security measures in ordinary businesses, while some are unique to the Cybersecurity Maturity Model Certification.

NIST vs. CMMC

Because CMMC is built on many of the same controls as NIST, it’s possible to jump to the conclusion that CMMC certification automatically provides NIST 800-171 compliance. However, it’s important to note that the two are different. 

While achieving CMMC Levels 3 through 5 certification satisfies all of the NIST 800-171 controls related to CUI, it’s important to note that Appendix E of 800-171 refers to 63 Non-Federal Organization (NFO) controls, that are tailored from NIST 800-53, and are basic controls that are expected to already be a part of any private organization’s security program.  Failing to have even these most basic controls in place means your are not in compliance.

Although IT is the focus of a majority of the practices and processes outlined in CMMC, it addresses more than just technology. That’s because employee negligence causes more than 40% of breaches. In fact, a majority of cyber professionals label people as the weakest link in security.

It’s no surprise then that CMMC goes beyond IT to address areas like physical security, personnel security, and awareness and training in its standards. For that reason, you should be wary of any service provider that tries to sell you a 100% software solution. Comprehensive cybersecurity includes both your tech and your team.

Software Can’t Fix Everything

Many of the top causes of data breaches can be traced back to your team, not technology:

1. Weak and stolen credentials/passwords
2. Malware
3. Social engineering (e.g., phishing)
4. Too many permissions
5. Insider threats
6. Physical attacks
7. Improper configuration, user error

All contractors that do business with the DoD will need to meet at least Level 1 CMMC requirements. The exact level at which you need to be certified to be awarded a contract will be specified in the RFP.

Although you do not have to be CMMC certified at the time of the RFP, you will need to be at the time the contract is awarded. That means you will have a window to start and complete certification, but how long that window is will vary from contract to contract. However, to avoid unforeseen delays and the risk of losing a contract, it’s best to not wait until the last minute.

To become CMMC certified, you’ll need to liaise with an accredited, independent third-party assessment organization through the Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB). You’ll specify your company’s level of cybersecurity maturity and schedule an evaluation.

CMMC assessors will be licensed through the CMMC-AB, but will be employed by a Certified Third-Party Assessment Organization (C3PAO).

Upon satisfying the security requirements for the requested tier, the assessing organization will grant you the appropriate certification. Your certification level will be available to the DoD via a database, but the findings of your cybersecurity audit will remain confidential.

Because all new DoD contract RFPs and RFIs will require CMMC compliance, those contractors that are certified will have a competitive advantage. That will be especially true early on, with most contractors likely waiting until they absolutely have to be CMMC compliant before pursuing certification.

What does that mean in real terms? With DoD contracts running five years, putting in the work now to become certified could put you in the lead to land five years of recurring revenue – and positioning yourself to retain it – while the rest of the market plays catch up.

Beyond easily winning and maintaining DoD contracts, CMMC-compliant companies will be better positioned to:

The Cybersecurity Maturity Model Certification represents a seismic shift for DoD contractors, and will have a significant impact on the industry and its practices. Here are three notable changes that are likely to happen:

1.  Cybersecurity Will Be Undebatable in DoD Procurement

• It will eliminate cases of multiple agencies carrying out security assessments on an entity at the same time.
• Independent evaluations will unify security assessment standards, ensuring that every company’s cybersecurity is being reviewed in the same comprehensive way.
• Neutral third-party audits won’t allow contractors to make deceptive or incorrect representations of their security hygiene. As a result, there will be fewer cases of legal rebuttal sparked by false claims.

2.  Some Companies Will Get Disqualified

3.  Industry Advisors Will Emerge

Each of the five CMMC levels requires the implementation of different NIST SP 800-171 Rev2 and NIST SP 800-171 Rev B controls. It’s the responsibility of each contractor to implement the necessary controls for the desired level of certification.

If you have implemented all of the NIST SP 800-171 Rev2 controls, then you’ll automatically pass the audit up to Level 2. If you’ve only adopted some, or none, of the controls, you can prepare for the Cybersecurity Maturity Model Certification by doing the following:

Do It Yourself

For those companies that have the internal resources, the Self-Assessment Handbook-NIST Handbook 162 from NIST is a good start. Because NIST 800-171 serves as a foundation for CMMC, meeting its standards will get you most of the way to a Level 3 CMMC certification.

However, because the book only covers NIST SP 800-171 Rev2, it’s only suitable for certification up to Level 2. Achieving Level 3 requires implementation of another 21 controls.

Outsourcing to a CMMC Consultant

If you don’t have the expertise or the resources to achieve the NIST SP 800-171 Rev2 or REV B requirements, you should outsource to an expert CMMC consultant. 

While there are many Managed Security Service Providers (MSSPs), at this point, not many have expertise in CMMC consulting, and fewer still will have experience going through the process.

Outsourcing saves you time and money, and it ensures that your company stays CMMC compliant. The key is finding an MSSP that can guide you through the certification process and help you maintain compliance going forward. Remember: When hiring a consultant, it’s still your responsibility to ensure you meet the necessary security standards.

When you engage with a consultant, they should guide you through several basic steps on the path to compliance.

Gap Analysis
The first step toward compliance is a gap analysis, which involves determining how far or close you are to meeting the minimum CMMC requirements. During a gap analysis, the MSSP will discover any ineffective system setup that doesn’t meet the criteria. This is achievable by taking a closer look at your network and procedures.

Some issues revealed during a gap analysis include:

• Measures controlling information access
• The training of information system administrators and managers
• Data record storage
• Implementation of security controls measures
• Incident response plans in place

Understanding these shortfalls helps you identify what changes your company needs to undertake to meet the appropriate CMMC-level requirements.

Remediation Plan
Using the findings of the gap analysis, your MSSP will provide a remediation plan. Depending on the results, the method may be inexpensive and straightforward network fixes. Or it could require extensive network development to help you meet standard NIST cybersecurity requirements.

Ongoing Monitoring and Reporting
Once your network systems are CMMC-level compliant, your MSSP should have tools to continuously monitor your system for any security breaches or incidents.

Documentation
As proof that you have implemented the necessary NIST SP 800-171 Rev 1 or REV B controls, the MSSP should provide you with documentation. You need to present this documentation to the CMMC auditors for them to certify you as a DoD contractor.

CMMC demands superior cybersecurity measures for contractors that wish to continue working with the Department of Defense. The journey will undoubtedly be bumpy for some suppliers, but the DoD is keen to cut ties with non-compliant parties in favor of those trusted to safeguard CUI.

The CMMC framework is still in development and likely will continue to be refined until and beyond its initial launch in January 2021. Contractors that wait on CMMC until the last minute will have to take immediate action or risk losing valuable revenue.

Meanwhile, contractors that stay ahead of the curve and get certified at the earliest possible date will have a leg up on the competition when the first CMMC-mandated contracts go to RFP.