How CMMC is a Unique and More Robust Mandate

By William Maki • June 21, 2021

As your organization is gearing up to start the process of attaining Cybersecurity Maturity Model Certification (CMMC), it is important to know how this cybersecurity standard compares to other regulations.

 

Five Ways that CMMC Differs from Other Laws.

 

1. CMMC is a certification.

Most regulations, laws, and mandates are attestations, but CMMC is more than that. It requires a third-party audit to certify that your organization is adhering to the cybersecurity practices and procedures the standard outlines. The audit must be completed by a CMMC third-party assessor organization (C3PAO), that will then make a recommendation to the accreditation body (AB) as to if your organization meets the certification requirements. Often attestations simply require a company to claim that they are compliant, relying on organizations to honestly self-report on their status without requiring information and artifacts for confirmation.

Seeking certification will significantly impact organizations. Each company must decide if they are going to take CMMC seriously, dive in, and get it done. Does the potential revenue from bidding on and securing DoD contracts make this effort worthwhile? Only your organization can make that important decision for itself.

 

2. CMMC is an audit and not a point in time assessment.

In order to count as completed and apply toward certification, the controls must be mature. An audit typically reviews organizational policies and behavior over a period of time. With CMMC, they want to look at the maturity of the processes. It’s not just about the product, software, and tools–it’s also about the process, procedures, and organizational learning around each control.

For example, with a point in time assessment, what often happens is an organization quickly implements the control or writes the policy, but that does not mean that that policy is fully implemented. Whereas with a CMMC audit, if a company has an acceptable use policy, the audit will review that policy, including the date it was created, timeline of changes to it, and other proof that it has been in place and is truly part of the way the company operates.

 

3. CMMC is piloted.

Most laws or regulations are introduced quickly with organizations receiving little to no guidance, other than the necessity of being compliant by a certain date. The DoD and AB are rolling CMMC out in a controlled manner to address any issues upfront. This approach also provides companies the time they need to determine what the mandate requires, as well as the opportunity to implement any new processes or procedures before certification is mandatory. CMMC will not be fully implemented until late 2025. Each year the AB will require a few more contractors and subcontractors to be certified.

 

4. CMMC is pass/fail.

If your company fails to comply with the requirements of certifications, you will be forfeiting your ability to secure valuable contracts from the DoD. As mentioned above, other regulations are self-reported attestations. If a company does not initially pass CMMC certification and therefore isn’t recommended to be certified by the AB, they reportedly have a 90-day period to remediate, address minor issues, and resubmit.  Any major deficiencies will require undergoing another assessment.

Your time commitment and the difficulty of passing CMMC depends on the size of your organization and maturity level you are hoping to attain as dictated by the type of contracts you wish to bid on and the types of information your company receives.

 

5. Interim scoring system promotes early adherence.

The Supplier Performance Risk System (SPRS) interim scoring allows your organization as well as the DoD to see how you are doing. The score can range from negative 203 to a perfect score of 110 if your company has implemented all 110 controls of NIST special publication 800-171 properly.

Under the current DFARS rule, all companies doing business with the DoD must log their SPRS score. The assessment that happens as you determine your SPRS score is extremely helpful as you build your remediation plans to address your compliance deficiencies. As you improve your cybersecurity by implementing better practices, you may update your SPRS score, notifying the DoD of your commitment to meeting their requirements.

SPRS is a helpful centralized tool to help you get ready for CMMC. It is a stepping stone to monitor your progress and to help you get to where you’ll need to be by the 2025 deadline.

 

Next Steps

If you have any questions about CMMC and how to make your path to compliance easier, get in touch with the experts at CyberSheath. We can help you assess where your organization is now, build a plan to enable you to reach compliance, and help you implement the processes and technology required. Contact us today to get started.

 

CyberSheath Blog

How to Safeguard Your Company from Phishing

Email is so ubiquitous in our everyday lives that it can be a challenge to always be on guard when receiving messages. Each day it’s not unheard of for each member of your team to have hundreds of messages land in their inbox. How do you make sure that none…

3 Tools to Help Defend Your IT Infrastructure from Threats

With the continually evolving threat landscape and the prevalence of team members working from home, it is more important than ever to be proactive with how your company is protecting itself from cyberattacks.  CyberSheath can help. We offer services to build on all the great work you have already done…

DNS Filtering for Additional Protection of IT Systems

Phase one of securing your IT infrastructure should include protecting your endpoints and safeguarding your employees from phishing attempts. After you have implemented these controls, the next logical step is to launch a DNS filtering solution.   What is DNS filtering and why do you need it? Domain name server…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO