RSI Security

Who Needs CMMC Certification? Do You Need It?

RSI Security
Technical

In November 2021, the DoD overhauled the Cybersecurity Model Maturity Certification (CMMC) program, leaving many Defense Industrial Base (DIB) organizations wondering whether they will still need to comply. But the question of who needs CMMC certification is less important than its corollary: which Level of CMMC certification do organizations need? The kinds of sensitive data involved in a current or prospective DoD contractor’s scope of work will determine what Level they need to meet and what controls they need to implement to do so—sooner rather than later.

 

What CMMC Level Do I Need to Meet?

The specific CMMC level your organization needs to achieve will be spelled out in the contract you apply for and earn with the DoD. However, there are some general expectations for the kind of work—and DoD contracts—that are likely to warrant Level 1, Level 2, or Level 3 certification.

This guide will cover everything you need to know about the CMMC certification levels:

Maintaining certification, at the appropriate level, is critical to securing DoD contracts.

 

Regulatory Context and Sources

The CMMC is overseen by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)). It was developed to streamline compliance with the Defense Federal Acquisition Regulation Supplement (DFARS) across the DIB.

The CMMC is designed to provide structure for organizations to implement National Institute of Standards and Technology (NIST) frameworks—namely Special Publications (SP) 800-171 and SP 800-172. These frameworks protect specific classes of information, the types of which determine which CMMC Level is needed.

 

Who Needs CMMC Level 1?

The question of who needs to be CMMC certified begins with those organizations at Level 1.

The primary purpose of DFARS and SP 800-171 and 172 is protecting the kinds of information critical to the safety of the DoD and, by extension, all US citizens. The first kind of information in this category is Federal Contract Information (FCI), which is defined in Federal Acquisition Register (FAR) Clause 52.204-21. Any organization that stores, processes, or otherwise comes into contact with FCI—but not more sensitive data—will likely need to meet CMMC 2.0 Level 1.

Organizations at Level 1 are subject to annual self-assessments to achieve CMMC certification.

 

CMMC Requirements at Level 1

Certification at CMMC 2.0 Level 1 does not touch all 14 Domains, adapted from the NIST SP 800-171. There are 17 Practices, spread across six Domains, comprising Foundational security:

These controls correspond roughly to the requirements at Level 1 for CMMC v1.02.

 

Request a Free Consultation

 

Who Needs CMMC Level 2?

Organizations that need Level 2 Certification for CMMC 2.0 are those that process more than just FCI. The other sensitive category of information protected by DFARS and SP 800-171 is Controlled Unclassified Information (CUI).

CUI is a wide-ranging category comprising many kinds of technical and defense-related information, such as repair manuals for weapons or machinery, which is sensitive but not officially classified. The security safeguards for CUI are defined in DFARS Clause 252.204-7012, informing the protections across NIST SP 800-171.

Organizations at Level 2 are subject to triennial third-party assessments for certification; a select subset of organizations at Level 2 may be eligible for annual self-assessments, like at Level 1.

CMMC Requirements at Level 2

Certification at CMMC 2.0 Level 2 requires full implementation of the NIST SP 800-171 framework, including all 110 Practices spread across all 14 Domains, for Advanced security:

These controls correspond roughly to the requirements at Level 3 for CMMC v1.02.

Who Needs CMMC Level 3?

At present, it is not completely clear who needs to comply with CMMC up to Level 3. Level 3’s infrastructure is intended to maximize protection for CUI, building upon the foundation that full NIST SP 800-171 establishes. Therefore, organizations with the largest repositories of CUI, or who depend most closely on CUI for daily functioning, are most likely to require Level 3.

One way to project whether your organization needs to reach Level 3 certification is to compare new contracts against older ones that assume the CMMC 1.02 framework as a basis. Level 3 in CMMC 2.0 is the equivalent of Level 5 in CMMC 1.02. If you needed Level 5 before, you likely need Level 3 now—and you’ll need to seek out triennial, government-led assessments to certify.

 

CMMC Requirements at Level 3

Certification at CMMC 2.0 Level 3 will require implementing controls from SP 800-172, which follow the same Domains as SP 800-171. The extent of these controls, which will comprise Expert security, are as-yet unknown. As the OUSD(A&S) develops the CMMC model further, more information should soon become available about what Level 3 certification will require.

What is known, at present, is that the controls for this Level will correspond roughly to the requirements at Level 5 for CMMC v1.02. Organizations should plan accordingly.

 

How RSI Security Can Help

For any current or prospective DoD contractor who needs CMMC certification, at any level, choosing a CMMC partner is one of the most critical steps on the path to full implementation.

RSI Security has been recognized by the Cyber AB (formerly the CMMC Accreditation Body (CMMC-AB)) as a CMMC Third-Party Assessor Organization (C3PAO).

We are prepared to facilitate every step of the implementation and certification process for organizations at every CMMC level. Our experts will help you understand the NIST SP 800-171 and 172 requirements, install controls to meet them, and gather evidence to facilitate annual or triennial assessments.

Contact RSI Security today to rethink your cyberdefense and streamline CMMC certification!

 

Speak with a CMMC compliance expert today – Schedule a free consultation

Exit mobile version