CMMC stands for Cybersecurity Maturity Model Certification and it is a cybersecurity framework, developed by the Office of the Undersecretary of Defense for Acquisition and Sustainment created for US defense contractors. It combines different standards and federal requirements to measure, elevate, and standardize the cybersecurity level of the defense supply chain. CMMC compliance is the Department of Defense (DoD)’s response to significant compromises of sensitive data located across the Defense Industrial Base (DIB)’s information systems.
The DIB has always been required to implement measures to monitor and secure the government information stored or transmitted in their systems. Contractors remain responsible for maintaining their systems and the data they handle securely, but the CMMC changes this by requiring third-party assessments of contractors’ measures with the required practices, procedures, and capabilities to work with the DoD.
At its core, CMMC is intended to safeguard sensitive national security information by determining how mature an organization’s current cybersecurity posture is. This includes whether the organization has the capacity to maintain its security and adapt to new and evolving cyberthreats
Who Needs CMMC Compliance Certification?
CMMC certification is required by organizations operating with DoD information. It will apply to contractors in the DoD supply chain who handle Federal Contracting Information (FCI) or Controlled Unclassified Information (CUI). This will affect suppliers at all tiers along the supply chain: small businesses, commercial item contractors, and foreign suppliers.
Depending on the type of information your company handles, gives the CMMC level you must be certified to. The CMMC Model 2.0 defines 3 levels:
Level 1 – Foundational. This only applies to companies that handle FCI data.
Level 2 – Advance. This is for companies handling CUI.
Level 3 – Expert. The main focus of this level is to reduce the risk from Advanced Persistent Threats (APTs).
The CMMC Accreditation Body (CMMC-AB) is working directly with the DoD to develop procedures to certify Third-Party Assessment Organizations (C3PAO) to evaluate an organization’s CMMC level. C3PAOs will perform a formal assessment to an Organization Seeking Certification (OSC) and then make a recommendation to the CMMC-AB on the issuance of CMMC certification. C3PAOs can only perform assessments, they may not advise or provide recommendations for compliance to an OSC.
However, an OSC seeking CMMC certification can hire a Registered Provider Organizations (RPOs) to provide consulting and guidance to evaluate their readiness and help them prepare to meet the standards required, before going through the CMMC assessment.
When will CMMC Compliance be Required?
CMMC Compliance Timeline Requirements are Accelerating
The DoD recently announced their plan to have the CMMC regulation in place by May 2023 and CMMC requirements into DOD contracts by July 2023. This means that any contractor who handles, transmits, processes, or stores CUI will need to have passed an accredited C3PAO’s assessment or risk the ability to bid on contracts.
This can be a fairly extensive process and organizations will need the help of an expert partner to discover the vulnerabilities in their system and to identify where improvements must be made to be CMMC ready. It takes an organization on average a minimum of 12 months to be ready to pass a CMMC assessment.
What Actions Should DoD Contractors Take?
CMMC will become an integral part of government contracts as the DoD will require CMMC compliance in all future Request for Proposals (RFP). The DoD estimates that the DIB includes more than 300,000 contractors that will all need the certification to continue to bid for contracts. Is your organization one of them?
The first step is to assess your current CMMC standing by hiring a professional with the credentials to perform the assessment and provide consulting advice to define a Plan of Action & Milestones and assist with the implementation of CMMC Controls & Practices. The CMMC Accreditation Body acknowledges RPOs, CMMC Certified Professionals (CCPs), and Registered Practitioners (CPs) as the certified entities able to consult an OSC and provide them with recommendations for the certification assessment.
The time to start the CMMC Compliance Process is now doing nothing is not an option if you work with the DoD.
What Are the Consequences for CMMC Non-Compliance?
Cybersecurity has become a top concern for the US government.
To ensure adequate security protection of sensitive data located across the Defense Industrial Base (DIB)’s information systems, the DoD will only award contracts to organizations that are CMMC compliant. This means that without a CMMC certification, you will lose out on doing any business with the government.
Although, there are no fines or penalties for non-compliance, by not implementing cybersecurity measures to monitor and secure your organizational data, it puts your business at risk. Research has shown that most organizations go out of business after a cybersecurity breach within six months due to the costs incurred on things like downtime of IT, recovery operations, legal fees, and loss of customer confidence/loyalty.
Do you need some help understanding CMMC? Are you interested in finding out whether your organization meets CMMC compliance? Empowered IT can help. Contact us today to find out more.