RSI Security

Preparing for DoD Compliance with the CMMC Framework

RSI Security

Organizations that work with the US military need to prove their security maturity with the CMMC framework. Preparation requires knowing the framework inside and out, scoping out what Level of compliance you need, and then implementing it and getting ready for assessment.

Is your organization ready for DoD compliance? Schedule a consultation to find out.

 

How to Prepare for CMMC Implementation

The Cybersecurity Maturity Model Certification (CMMC) is a form of regulatory compliance required for organizations in the Defense Industrial Base (DIB) sector. It proves they’re ready to secure sensitive information critical to the security of US military personnel and all Americans.

Certification can be challenging, but preparation can be streamlined into three basic functions:

Working with a CMMC advisor will help you plan and execute your implementation.

 

Understanding the CMMC Framework

The DoD uses CMMC assessments to ensure that contractors it works with can protect specific kinds of sensitive data germane to military contract work. Organizations seeking contracts will implement a specific set of controls based on the Level required per their contract. Then, they conduct assessments (self-assessment or assisted, based on Level) to achieve certification (compliance).

The CMMC was originally released in 2020 under the supervision of the Office of the Under Secretary of Defense (OUSD) Acquisition and Sustainment (A&S). But it is now overseen by the DoD’s Chief Information Officer (CIO) with input from OUSD Intelligence and Security (I&S).

Upon its release in 2021, the CMMC 2.0 framework replaced CMMC v1.02, with major changes to the way it gauges maturity. It has different controls and a simpler Level schema. It also overhauled the assessment protocols, emphasizing flexibility and accessibility over rigid uniformity. Still, even with these changes, understanding what’s required can be challenging.

 

Request a Consultation

 

Implementation: What Controls Do You Need?

CMMC is a cyber maturity model, meaning that it measures the depth and complexity of an organization’s systems. It accounts for a range of maturities, which it categorizes as Levels.

At all Levels, organizations implement a set of practices derived from the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-171 and SP 800-172:

The Level your organization needs to achieve will likely be spelled out in a specific contract you are targeting. Beyond this, organizations can also undergo scoping to assess what Level they’ll need based on the kinds of data most closely associated with their work (see below).

Assessment: How to Verify Security Maturity

The DoD also requires different assessment protocols at each Level, providing more or less assurance at different intervals. At present, the specific requirements break down as follows:

One major goal in the CMMC 2.0 rulemaking involved reviewing and resolving conflicts that had arisen in the CMMC assessment ecosystem. The new and improved Cyber AB (formerly CMMC Accreditation Body) certifies assessors for third-party assessors for most Level 2 organizations.

 

Determining Your Implementation Scope

As noted above, the CMMC Level your organization needs to achieve should be established on the DoD contract you’re targeting. However, if your organization is taking a proactive approach and seeks certification prior to competing for a contract, it can also determine its likely scope by the kinds of data it manages. Working with a compliance advisor can also help you scope.

In general, CMMC Level 1 applies primarily to Federal Contract Information (FCI), whereas Level 2 concerns both FCI and Controlled Unclassified Information (CUI). FCI includes data concerning government contracts not suitable for public release. CUI is broader in scope, including any information deemed sensitive but not fully classified. The Information Security Oversight Office (ISOO) maintains a registry of all CUI types and relevant regulatory bodies.

Scoping guidance documents available from the DoD clarify which assets are in scope for CMMC assessments at Levels 1 and 2. At present, no such guidance is available for Level 3.

 

CMMC Level 1 Scoping Guidance

According to the official Level 1 scoping documentation, the primary focus of CMMC Level 1 assessments is “FCI Assets.” These are any virtual or physical assets that can do the following:

Any assets that do not allow for these functions are not in scope for Level 1 assessments and thus do not need to be accounted for in any official capacity. There are also “Specialized Assets” that do not need to be assessed as long as they are documented properly. These include but are not limited to government properties, Internet of Things (IoT) devices, and test equipment.

 

CMMC Level 2 Scoping Guidance

Per the DoD’s Level 2 scoping documentation, the primary focus is “CUI Assets.” Like FCI Assets, these include any software or hardware that process, store, or transmit documents that constitute or contain CUI. Beyond Level 1 requirements, organizations must provide a basic network diagram of all CUI Assets and other in-scope assets during their pre-assessment.

And, in addition to CUI Assets, Level 2 scoping also includes the following:

The only fully out-of-scope assets for Level 2 assessments are those that are physically or logically segmented away from CUI such that they have no connection to it whatsoever.

 

CMMC Level 3 Scoping Speculation

At present, the DoD has not publicly stated what threshold of CUI processing or other factors will necessitate CMMC Level 3 assessment. However, it can be assumed that organizations with greater amounts and varieties of CUI are most likely to require the highest CMMC Level.

In addition, insights from earlier versions of CMMC may be useful here. Namely, before the overhaul to CMMC 2.0, there were five Levels instead of three. The DoD maintains that the current Level 3 corresponds with what was Level 5 in the previous version. And that Level specified that its heightened protections were required for organizations that face advanced persistent threats (APT) to CUI. This suggests that the threshold for Level 3 in the current version may also depend upon risk factors in addition to the volume and variety of CUI controlled.

 

Implementing and Assessing Security Practices

Equipped with the knowledge of your assessment scope, all that remains is implementing controls and ensuring systems are ready for self-, third-party, or government-led assessments.

As noted above, the practices that comprise the CMMC 2.0 framework are adapted from NIST Special Publications. The DoD provides detailed assessment guidance documents that explain which controls are required at Levels 1 and 2. NIST SP 800-171 distinguishes between Basic and Derived Requirements, which CMMC does not. And NIST SP 800-172 builds on this distinction further, adding “Enhanced” Requirements to already-established protections.

While no formal information is available yet about which practices from NIST SP 800-172 are applicable at Level 3, familiarity with its controls will aid in assessment preparation efforts.

CMMC Level 1 Implementation Requirements

NIST SP 800-171 comprises 110 Requirements distributed across 14 Families. In CMMC 2.0, corresponding controls are called “practices,” and their groupings are not named (they were “Domains” in CMMC v1.02). Level 1 covers a small number relative to the entire SP 800-171.

Per the Level 1 assessment documentation, the required practices break down as follows:

Organizations preparing for CMMC Level 1 can also begin implementing additional controls from the remainder of NIST SP 800-171, since all of them will be required for CMMC Level 2.

 

CMMC Level 2 Implementation Requirements

At CMMC Level 2, organizations implement 110 practices that cover the entire range of controls in NIST SP 800-171. Organizations that were already NIST compliant may find that mapping protections from those Requirements to CMMC practices is a straightforward process.

According to the Level 2 assessment documentation, these are the added practices:

Similar to Level 1, organizations preparing for Level 2 might consider beginning to implement controls from NIST SP 800-172. They build on SP 800-171 and are required at Level 3.

CMMC Level 3 Implementation Speculation

As noted above, no information is available yet on the exact specifications of CMMC Level 3 assessment. However, the DoD has established that practices would be adapted from NIST SP 800-172, which utilizes the same Families as SP 800-171, adding 35 new Requirements.

It can be assumed that the practices for Level 3 will be based on some or all of the following:

Organizations that process the most CUI, or who are exposed to the most advanced threats to that CUI, should consider implementing some or all of SP 800-172 in preparation for Level 3.

Working with an advisor is the best way to streamline your CMMC and NIST implementation.

 

Optimize Your CMMC Framework Implementation

Organizations preparing for DoD compliance need to understand the CMMC 2.0 framework in its entirety. That will allow for an accurate scoping and efficient implementation, which in turn will set you up for streamlined self, third-party, or government assessment.

RSI Security has helped countless organizations prepare for and achieve DoD compliance on the road to lucrative military contracts. We’re committed to service above all else, helping your organization plan for and execute security assurance so you can focus on what you do best.

For further guidance on CMMC framework implementation, assessment, and what you should do to prepare for seamless DoD compliance at any Level, contact RSI Security today!

 

Request a Free Consultation

 

Exit mobile version