Organizations that work in close proximity to government entities, like the US military, come into contact with several protected forms of information. One of the most critical kinds, for national security, is controlled unclassified information (CUI). It’s imperative to understand the processes and logistics of controlling and decontrolling CUI, such as who can decontrol CUI and who has a responsibility to protect it (and how). Read on to learn what your organization may need to do.
To secure Department of Defense (DoD) and other government contracts, organizations must demonstrate compliance with specific frameworks that help protect federal contract information (FCI) and controlled unclassified information (CUI), such as CMMC 2.0 and NIST SP 800-171. NIST SP 800-53 Rev 4 provides a complementary framework, but it’s not mandatory like the other two. Still, SP 800-53 substantially informs and maps to SP 800-171 and CMMC 2.0.
In November 2021, the DoD overhauled the Cybersecurity Model Maturity Certification (CMMC) program, leaving many Defense Industrial Base (DIB) organizations wondering whether they will still need to comply. But the question of who needs CMMC certification is less important than its corollary: which Level of CMMC certification do organizations need? The kinds of sensitive data involved in a current or prospective DoD contractor’s scope of work will determine what Level they need to meet and what controls they need to implement to do so—sooner rather than later.
If your organization works with government entities as a contractor, you probably have some questions about NIST SP 800-171, CMMC, or even NIST SP 800-53 compliance. Below, we’ll answer questions like what is NIST SP 800 171, how does CMMC differ from it, and what are NIST 800-53 controls? Understanding the answers to these questions covers most everything you need to know for the DoD compliance efforts necessary to secure lucrative contracts with the military and other agencies.
The Cybersecurity Model Maturity Certification (CMMC) framework protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) processed by Department of Defense (DoD) contractors. On November 4, 2021, the DoD announced a massive overhaul of CMMC version 1.02 and the imminent release of CMMC 2.0. The new framework is not yet publicly available, leaving many organizations with questions about how they’ll need to adjust.
If your company currently works closely with the Department of Defense (DoD) or plans to begin a lucrative partnership with the military, you will soon need to acquaint yourself with a managed security service provider (MSSP) that’s been vetted by the Cybersecurity Maturity Model Certification Accreditation Body (CMMC AB). There are many such organizations and many different kinds you’ll find on the CMMC AB Marketplace.
If your organization currently works as a contractor with the Department of Defense (DoD), compliance is likely a critical component of your contract. Current Defense Federal Acquisition Register Supplement (DFARS) requirements include adherence to the National Institute of Standards and Technology (NIST) Special Publication 800-171 (SP 800-171). However, your next contract will likely require CMMC implementation.
Companies need to ensure security over sensitive data to work with the Department of Defense (DoD) as a contractor or vendor.
Companies seeking out lucrative contracts with the Department of Defense (DoD) need to show their commitment to security by attaining Cybersecurity Model Maturity Certification (CMMC).
Companies seeking out lucrative Department of Defense (DoD) contracts as part of the Defense Industrial Base (DIB) sector need to prepare for rigorous security verification.