RSI Security

From NIST 800-171 to CMMC: A Comprehensive Defense Compliance Guide

Nicholas Giatrelis

Department of Defense contractors and subcontractors have a big change to cybersecurity governance regulations. Current cybersecurity standards (NIST 800-171) are being updated into a new framework called CMMC.

The CMMC Accreditation Body recently recommended that the best place to start with CMMC is by becoming NIST 800-171 compliant. RSI Security provides NIST 800-171 assessments, so we brought our experts together to provide a comprehensive guide to achieving CMMC compliance. This guide includes understanding the basics of CMMC and outlines a phased approach to gaining the highest level of CMMC.

 

What is CMMC and who is it for?

CMMC stands for Cybersecurity Maturity Model Certification. CMMC is a new framework for organizations doing business with the Department of Defense (DoD). CMMC applies to any organization that stores, processes, and/or transmits either:

  1. Federal Contract Information (FCI)
  2. Controlled Unclassified Information (CUI)

 

The evolution of CMMC

CMMC evolved from the current NIST 800-171 standard. According to the DoD, malicious cyber activity is costly to the US economy. In 2016, malicious activity cost an estimated $57 billion to $109 billion dollars[1]. It is more than the money though. Any loss of CUI has an impact on both the national economic security and national security. It is the duty of the Defense Industrial Base (DIB) to reduce this risk through excellent cyber hygiene.

 

Other reasons for creating CMMC

The DoD believes CMMC will enhance the cybersecurity posture of the DIB. Two major aspects of CMMC that will help enhance the DIB’s cybersecurity posture are:

  1. Requiring third-party assessors to verify contractor and subcontractor compliance
  2. Defining the CMMC level on a contract-by-contract basis, because each level has a different scope of focus

 

Assess your NIST 800-171 / DFARS / CMMC compliance

 

Basic CMMC terminology and concepts

In order to understand CMMC, let’s go through the essential terms and concepts.

 

CMMC consists of domains, capabilities, and practices

Domains and Capabilities are a way to categorize the practices. A domain (e.g. Access Control) contains one or more capabilities (e.g. establish system access requirements) which in turn have one or more practices. Practices are the security controls, or the activities performed to ensure security. An example of one practice would be: “Limit information system access to authorized users[…].”

The CMMC processes

CMMC is more than practices, it also includes processes that apply to all domains. A process is how an organization ensures effective implementation of practice activities. An example of a CMMC process would be: “Establishing policies” or “documenting procedures.” CMMC is a maturity model. The applicable practices and processes increase at each level.

 

What is a maturity model?

A maturity model is a benchmark of best practices and standards. Maturity models often contain levels to evaluate progression. These levels are like sports leagues where a baseball player is evaluated and placed into Double A, Triple A, or Majors. Organizations test their current capabilities against the benchmark. Then, in turn, use the progression as a prioritized roadmap to get to their desired level.

 

The five levels of CMMC

CMMC contains five levels of maturity. Each CMMC level will continue to add practices and processes. This is because each level has a unique focus.

 

How practices and processes build at each level


Figure A - Total number of practices (in purple) at each level; documented processes required at each level.

 

Figure A demonstrates how many practices and processes exist within each level. CMMC has a total of five processes. Level one requires minimal to no maturity in processes. Level five requires optimized processes across the entire organization.

 

Implementation of practices and processes

While progressing through the levels, any new process added needs to cover previously implemented practices. For example, level one does not include documented policies. Level two will require documented policies for all level one and level two practices, a total of 72 practices. In level three there are 58 practices added. Documentation started in level two will now need to include the new practices.

 

Determining level certification

An organization must follow all related practices and processes to certify at a given level.

Example: An organization implements all level three practices. The documentation is only for level two processes, and not the level three managed plan. The organization is then only eligible for level two certification.

 

How to prepare – a phased approach

Preparation should follow the maturity model; with the same three steps:

  1. Assess practices & remediate as needed
  2. Document processes
  3. Level up

If an organization is working on NIST 800-171 compliance, a similar approach should be used focusing on the 110 CMMC practices that map to NIST 800-171. These are found in levels one through three.

 

Start preparation for CMMC with Level One

Using a phased approach described above, start with assessing all 17 practices included in level one. Level one does not include documentation. Consider using this subset of practices to start documenting policies and procedures. This way it is more of a warm-up before documenting all 72 practices in level two.

 

How to assess compliance

First, go through all practices and determine which are applicable to the organization. Next, determine the state of applicable practices. Is the implementation of the practice in full, partial compliance or non-compliance?

To assist with making these determinations, use the following resources:

Create a remediation plan for any practices not assessed at “Full Compliance.” This is best documented in a “Plan of Actions & Milestones” (POA&M) type document.

 

How to document policies

The first process to put in place is “documented policies.” CMMC defines a policy as a high-level expectation for planning and performing. A policy should include:

 

How to document practices as procedures

For the second process, CMMC states that “Practices need to be established, documented, and followed.” Think of a documented procedure. The elements of this documentation include:

For levels two through four the detail can vary. Documentation can be as simple as a handwritten desk procedure or something more formal. In level five this documentation will become managed and controlled as an organization-wide standard operating procedure.

 

Continue with assessing Level Two

Move on to level two after assessing, planning remediation, and documenting level one. Begin again with assessing and planning the remediation of the new practices. There are 55 new practices from level one to level two, which is the second-largest jump in the number of practices.

 

Add to documentation

After the level two assessment, add the new practices into the existing documented policies and procedures. Level two also has a practice that requires a System Security Plan (SSP). It is important to start this documentation as well. An SSP is a requirement for NIST 800-171 today.

Assess and document Level Three

When ready for level three, start again by assessing and planning remediation for new practices. This is the largest addition of practices between levels. A total of 58 new practices moving from level two to three. Add these new practices to existing documented policies, procedures, and the SSP.

 

Congratulations on NIST 800-171 compliance

An organization achieves NIST 800-171 compliance when they have:

  1. Implemented or documented remediation for all level one through three practices. Or at minimum the subset of those practices that came from NIST 800-171.
  2. Implemented documented policies, procedures, and the SSP.

This is a huge achievement, and further continuation will assist with future CMMC compliance. It is recommended to continue with the managed plan process at least, in order to complete all level three requirements. It is also important to note that CMMC requires all items to be remediated for certification, and POA&Ms will not be accepted.

 

Implement the Level Three process

The level three process is creating and documenting a “managed plan.” This plan outlines how the organization will achieve compliance in each domain. The CMMC defines a “managed plan” to be the strategic level objectives to inform the leadership of the status as it relates to each domain.

 

The elements of a managed plan

The managed plan can be stand-alone, embedded in a more comprehensive document, or distributed among multiple documents. No matter which way it is implemented, it is important to have the following elements:

 

 

Documenting “organizational resources” for all activities

CMMC indicates the project plan in the level three managed plan needs to include:

 

Assess and document Level 4

In level four there are only 26 new practices. Start with assessing the new practices. Add the new practices to existing documentation (policies, procedures, SSP, and managed plan) . Once completed, it is time to focus on the level four process.

 

Level Four process requirement

The level four process is how the organization reviews and measures implementation effectiveness. Refer to the SMART goals from the managed plan for measuring practice implementation. CMMC indicates that corrective action is necessary when goals are not met.

 

The elements of a review process

Assess and document Level Five

Level five is the last and highest step in CMMC. Begin with assessing the last 15 CMMC practices. Then add the last practices to all previous documentation. After that, it’s time to put in place the fifth process.

 

Documenting standard practices

The fifth process is standardizing practices across the entire organization to create consistency. Use an asset library to manage and control the standards. Create a review process by which to make changes or updates. The organization should document lessons learned from planning and performing these practices.

 

How to document standard practices

A standardized practice should include the following:

 

Repeating the three steps for all levels takes time

There it is, the three steps to achieving CMMC compliance:

  1. Assess practices & remediate as needed
  2. Document processes
  3. Level up

Do not wait to start, as achieving CMMC will take considerable time and resources.

 

171 practices and five processes to achieve the highest compliance

If the highest level of CMMC is your organization’s goal, then there is a lot of work to be done. In addition to implementing 171 practices, there are the five processes:

  1. Documented policies
  2. Documented procedures
  3. Managed plan
  4. Review process
  5. Standardized organization-wide procedures

 

Remember that the best place to start is with NIST 800-171. This gives organizations the best chance to achieve CMMC level three compliance.

 

RSI Security can help

RSI Security can conduct assessments against the existing NIST 800-171 standards. During a NIST 800-171 assessment, we will take into consideration current CMMC information provided. Other services we provide include:

 

Speak with a NIST 800-171 / DFARS / CMMC compliance expert today!

 

Sources

  1. https://www.acq.osd.mil/cmmc/faq.html
Exit mobile version