WHAT IS CMMC?

Any organization (manufacturing company) hoping to work within the defense contract supply chain will need to meet the standards set by the Cybersecurity Maturity Model Compliance (CMMC). Managed by the Department of Defense (DoD), the CMMC is a tiered system of compliance measures, which are intended to evaluate the maturity of the organization’s cybersecurity systems, processes, and contingencies. CMMC was introduced in 2020, refined in 2021, and will be fully required by 2026.

Even if you’re a (manufacturing) organization that’s not looking to work with the DoD – being CMMC compliant can benefit you because it works to actively improve your cybersecurity measures.

CMMC describes a (manufacturing) company’s preparedness against key security issues. A low score on the CMMC model means that your organization is ill-prepared for potentially malicious actions, whereas a high score on the CMMC model will mean that your organization has taken active, critical steps toward mitigating malicious actors.

There are three tiers of certification in the CMMC 2.0 model:

1. CMMC level 1, “Foundational,” is the most basic level of compliance. This includes basic security practices, including access controls, implementing identity controls, and performing password protection. Level 1 companies don’t have a complete security strategy, they only know the basics. Many organizations start here, then improve their security solutions.
2. CMMC level 2, “Advanced,” is a reasonably advanced level of security compliance. If your (manufacturing) organization is hoping to work with Controlled Unclassified Information (CUI), then you will need this level of compliance. Organizations hoping to achieve Level 2 will need to follow the 110 best security practices aligned with NIST SP 800-171.
3. CMMC level 3, “Expert,” is the highest level of certification and what most organizations should aspire to be at. Organizations should be practicing advanced and progressive cyber hygiene, continually optimize their security processes, and analyze their network traffic. Organizations will need a sophisticated understanding of auditing, accountability, access control, and incident response. Achieving CMMC Level 3 will require an organization to follow a set of 110+ practices based on NIST SP 800-172. It will also require government-led audits, as opposed to the third-party audits necessary for achieving Level 2. 

HOW DOES IT AFFECT ME?

It’s important to focus on the maturity part of the Cybersecurity Maturity Model Certification: compliance is everchanging.

New threats and defenses are established all the time, so an integral part of compliance at any level is maintaining that compliance. This can be challenging, and it is a major process to meet CMMC requirements.

Creating, enforcing, and maintaining security controls take time and when certification is available, manufacturers (you) don’t want to be left behind.

We may experience a backlog from those that are ready for certification between now and when the certification goes live. And remember that meeting CMMC Level 2 will be required for all Department of Defense (DoD) contractors, with self-attestation being minimum for Level 3 capabilities with third-party certification being required for some contractors. 

There is also a complete culture shift involved with achieving the above levels of certification. Everyone needs to be aware of their role upholding compliance at every level of your organization. Therefore, these new compliance requirements mean more than just a change to the policies of your IT department. More importantly, there will be changes to how information is handled throughout your organization, and IT will underpin these changes across each department. 

PRO TIP: HOW ICS DATA HELPS WITH CMMC COMPLIANCE

A business can think of CMMC as a measure of their general cybersecurity health. While CMMC has been designed specifically for DoD contracts, most of the requirements of CMMC apply to any organization dealing with critical, personally identifiable or protected information.

To tackle most DoD contracts, organizations will need basic CMMC compliance. But, that doesn’t mean that achieving better compliance shouldn’t be the ultimate goal of an organization and its IT team.

By working with us, a business can ensure that they are moving toward better cybersecurity — including CMMC compliance requirements. An organization won’t need to devote significant amounts of internal time toward compliance and will be able to achieve better compliance faster.

GET THE LATEST CMMC 2.0 UPDATES HERE!

2022 – Q4

CMMC: The Latest

• Rule to be sent to OIRA October 2022.
• Final interim/proposed rule to be released March 2023.
• Rule in contracts beginning May 2023.
• CMMC compliance takes 9-12 months.
• Sec. 866 of the 2022 NDAA requires a report on the impact of
CMMC on small businesses within 180 days. The report must
include:
− the estimated costs of complying with each level of the
framework;
− any decrease in the number of small business concerns that
are part of the defense industrial base resulting from the
implementation and use of the framework; and
− an explanation of how the Department of Defense will mitigate
the negative effects to small business concerns that are part
of the defense industrial base resulting from the
implementation and use of the framework.”

2022 – Q3

CMMC: The Latest

• How it will work:

− DoD entered into an MOU (and now contract) with a
single CMMC Accreditation Body (AB).
− The AB will implement the CMMC model, train and
certify assessors, and evaluate assessments. The
AB sits between DoD and the contractors.
− There will be three levels of assessment with the
third being the most stringent.
− DoD will assign a CMMC rating to each contract
and only contractors that have had a successful
assessment at that rating can perform.
− It is unknown who will assign certification levels
required to subcontractors and enforce that.