IDENTIFYING CMMC

You may need CMMC if your organization handles controlled unclassified information (CUI) for the US Department of Defense (DoD) and intends to bid on DoD contracts that require it. CMMC compliance is mandatory for all organizations that want to perform work for the DoD and handle CUI as part of that work.

Additionally, if your organization is involved in supply chain management or works with other organizations that handle CUI for the DoD, you may need to demonstrate compliance with CMMC to maintain those relationships.

It is important to note that the CMMC is only applicable to organizations that are directly involved with the DoD and handle CUI. If your organization does not fall into this category, it may not need to comply with the CMMC.

If you are unsure if your organization needs CMMC, it is recommended that you consult with a professional who is familiar with the requirements of the DoD and the CMMC framework.

HOW DO YOU KNOW IF YOUR ORGANIZATION HANDLES CONTROLLED UNCLASSIFIED INFORMATION?

Here are some steps to determine if your organization handles controlled unclassified information (CUI):

1. Review your contracts and agreements: Review any contracts or agreements with the US Department of Defense (DoD) or other government agencies to determine if they require the handling of CUI.

2. Assess your information systems: Assess your information systems and data to determine if they contain any information that is considered CUI. This information may include sensitive but unclassified (SBU) information, confidential business information (CBI), or other sensitive information that is not classified but still requires protection.

3. Review your data protection policies and procedures: Review your organization’s policies and procedures for data protection and security to determine if they specifically address the handling of CUI.

4. Consult with experts: Consult with cybersecurity experts, legal counsel, or other professionals who are familiar with the handling of CUI to determine if your organization is handling this type of information.

It is important to note that CUI includes a wide range of information, including technical data, software, and systems, as well as non-technical information such as personnel, financial, and legal information. If your organization handles any of this type of information, it is important to ensure that appropriate controls are in place to protect it.

WHAT ARE THE DOWN FLOW REQUIREMENTS OF CMMC?

The down flow requirements of the Cybersecurity Maturity Model Compliance (CMMC) refer to the requirements that organizations must meet in order to comply with the CMMC framework. These requirements flow down from the DoD to its contractors and suppliers who handle controlled unclassified information (CUI).

The CMMC framework consists of multiple levels, ranging from basic cybersecurity hygiene to advanced and proactive security practices. The specific down flow requirements for each level of the CMMC vary, but generally include the following types of controls:

1. Access controls: Controls to ensure that only authorized individuals can access CUI.

2. Asset management: Controls to ensure that CUI is properly identified, classified, and protected.

3. Configuration management: Controls to ensure that systems and devices used to handle CUI are configured in a secure manner.

4. Identity and access management: Controls to manage and monitor the identities of individuals accessing CUI.

5. Incident response: Controls to ensure that incidents involving CUI are promptly detected, reported, and responded to.

6. Maintenance: Controls to ensure that systems and devices used to handle CUI are properly maintained and updated.

7. Media protection: Controls to protect CUI during storage, transportation, and disposal.

8. Personnel security: Controls to ensure that personnel who handle CUI are properly vetted and trained.

9. Recovery: Controls to ensure that CUI can be recovered in the event of an incident.

10. Risk management: Controls to manage and mitigate the risks associated with handling CUI.

These are some of the down flow requirements of the CMMC. Organizations must meet the requirements for the specific level of the CMMC that they are being assessed against. It is important to note that the down flow requirements for the CMMC are subject to change as the framework evolves and new threats emerge.