Are You CMMC Certified?

The final CMMC rule went into effect December 16, 2024.

The DOD has never been clearer about the need to work hand-in-hand with the industry to support its defense IT modernization efforts; however, it must ensure its IT systems and data are protected from cyber threats and that contractors supporting its mission are aligned with cybersecurity requirements. These requirements have become increasingly critical as recent warnings from the NSA reported our adversaries, including China, Iran and Russia are actively targeting the defense industrial base. In 2019, the DOD announced the creation of The Cybersecurity Maturity Model Certification (CMMC) as it recognized the need to create a measure that standardizes cybersecurity practices across the defense industrial base (DIB) to protect sensitive federal contract information (FCI) and controlled unclassified information (CUI). CMMC 1.0 was officially released in January 2020. Since then, it has undergone revisions to improve the certification process and better align with the existing National Institute of Standards and Technology (NIST) guidelines.

Despite the importance of CMMC, the initiative has seen its challenges in adoption, particularly among small businesses to be CMMC certified. A recent survey showed that compliance and knowledge of achieving and maintaining CMMC is alarmingly low; merely 4% of defense contractors meet the DOD minimum cybersecurity requirements. Contributing factors to these challenges included complexity and cost of implementing, evolving requirements, ROI and difficulties in the application process.

In its effort to improve the model and address the industry adoption challenges, the DOD rolled out CMMC 2.0 in 2021 aiming to reduce complexity and improve adoption among the DIB, particularly for small and medium-sized companies. The previous five levels of cybersecurity were then reduced to three. And after quite some time and anticipation in the market, the "CMMC rule" was finalized on October 15, 2024, with (phased-in) implementation into contracts coming in 2025.

Defense contractors can determine the necessary CMMC level of compliance based on the sensitivity of the information they handle. The model includes both self-assessment and third-party assessments depending on scope as follows:

• Level 1 (Foundational): Applies to contractors that handle Federal Contract Information (FCI) and must conduct an annual self-assessment to affirm that they have implemented all basic safeguarding requirements to protect FCI.
• Level 2 (Advanced): Applies to contractors handling Controlled Unclassified Information (CUI). Assessment involves both self-assessments and third-party assessments; the specific type of assessment depends on the criticality of the contract:
  • Self-Assessments: For less critical contracts, contractors can perform annual self-assessments.
  • Third-Party Assessments: For more critical contracts, assessments must be conducted by a CMMC Third Party Assessor Organization (C3PAO); these assessments are valid for three years.
• Level 3 (Expert):Applies to contractors supporting the Department of Defense’s (DOD) most critical programs and technologies; this level requires government-led assessments and contractors must meet all requirements of levels 1 and 2, plus additional advanced security measures specified in NIST SP 800-172.

Strategies for Success with CMMC Certification

IT companies and defense contractors can expect to see CMMC requirements in DOD solicitations and contracts beginning in early to mid-2025. Contractors will have to demonstrate possession of the appropriate level of CMMC certification as a condition of the contract award. To achieve CMMC certification, IT companies will want to follow a structured approach that includes the following directives and steps indicated by the DOD’s standards:

1. Understand Your Required CMMC Level: Determine which CMMC level your organization needs based on the type of information you handle (e.g., Federal Contract Information (FCI) or Controlled Unclassified Information CUI).
2. Conduct a Gap Analysis: Perform a thorough assessment of your current cybersecurity practices to identify gaps between your existing controls and the CMMC requirements for your desired level.
3. Develop a System Security Plan (SSP): Create an SSP that documents your cybersecurity practices, policies and procedures; this plan should outline how your organization meets the CMMC requirements and address any identified gaps.
4. Implement Required Controls: Based on your gap analysis, implement the necessary security controls to meet the CMMC standard; this may include measures such as access controls, incident response plans and data encryption.
5. Conduct Internal Assessments: Regularly perform internal assessments to ensure ongoing compliance with CMMC requirements.
6. Engage a Certified Third-Party Assessor Organization (C3PAO): For Level 2 and Level 3 certifications, engage a C3PAO to conduct an official assessment of your cybersecurity practices. This independent evaluation is crucial for obtaining certification.
7. Submit Affirmation of Compliance: After completing the assessment, submit an affirmation of compliance by a senior representative of your organization, confirming that all applicable CMMC requirements are met.
8. Maintain Compliance: CMMC compliance is an ongoing process; continuously monitor and update your cybersecurity practices to ensure they remain effective and compliant with CMMC standards.

The creation and evolution of the CMMC shows a clear commitment of the DOD to working with industry while ensuring robust cybersecurity measures are in place to protect national security interests. While challenges within the defense industrial base remain, CMMC 2.0 intends to foster greater adoption among defense contractors. By performing a systematic approach, your DIB organization can effectively prepare for and achieve CMMC certification, ensuring you meet the necessary cybersecurity standards to handle sensitive defense information and maintain the integrity of the defense operations.

To get more TD SYNNEX Public Sector Market Insight content, please visit our Market Intelligence microsite.
 

About the Author:
Toan Le is focused on providing insights on federal IT buying trends, with a particular focus on the Department of Defense and the Intelligence Community. Over the past years, his work ethic, diverse skill sets, and professional experience in research, analytics, information technology, and public health have made a solid contribution across the public and private sectors. Toan earned his doctorate from the Johns Hopkins University, Bloomberg School of Public Health.