CMMC 2.0

The Cybersecurity Maturity Model Certification (CMMC) program was enhanced in November 2021 by the U.S. Department of Defense (DoD) under “CMMC 2.0”. Contractors safeguarding sensitive information mature their cybersecurity defenses against evolving cyber threats. CMMC version 2.0 is structured based on three increasingly progressive requirement levels. Moreover, each level maps to the sensitivity level of the data the Defense Industrial Base contracting is processing under their contract. The sensitive data types are Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) data collected, created, transmitted, or received as a requirement of fulfilling the contract’s obligations – to develop or deliver a product or service. FCI information is not marked as public or for public release and is subject to minimum cybersecurity requirements, such as CMMC Level 1.

Typically, FCI originates from government addresses in emails, systems that store files from the government, hard drives, workstations, manufacturing devices, or backups.

Conversely, CUI data requires safeguarding through controlled dissemination even though it is not considered classified – it is information that legally cannot be made public. CUI must legally be protected even when the data is not sensitive enough to require a high-level security level clearance to access. CUI data leaked or accessed by our adversaries could negatively impact national security.

Examples of CUI include legal material, health documents, technical drawings and blueprints, intellectual property, and ITAR-controlled documents/products. Click here for a link to the CUI Registry housed in the National Archives. Look at each category, not just the Defense category.

Essentially, The DoD is migrating to the new CMMC framework to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC serves as a verification mechanism to ensure cybersecurity controls and processes are adequate to protect Controlled Unclassified Information (CUI). If FCI or CUI data is collected, transmitted, created, or stored by the DIB contractor, CMMC is a requirement. Praetorian Secure can ease the burden of meeting CMMC compliance requirements with services tailored to help your organizations meet CMMC requirements (CMMC Level 1, CMMC Level 2, or CMMC Level 3 under development).

About CMMC Version 2.0:

• The CMMC version 2.0 combines various cybersecurity standards and best practices. The standard maps these controls and processes across several maturity levels that range from basic cyber hygiene to advanced.
• CMMC 2.0 builds upon the initial CMMC framework to dynamically enhance Defense Industrial Base (DIB) cybersecurity against evolving threats.
• The DoD worked with John Hopkins University Applied Physics Laboratory (APL) and Carnegie Mellon University Software Engineering Institute (SEI) to review and combine various cybersecurity standards into one unified cybersecurity standard.
• The CMMC 2.0 changes build upon existing regulations (DFARS 252.204-7012). The updated standard requires verification of meeting CMMC requirements.
• The CMMC will be semi-automated and, more importantly, cost-effective for Small Businesses achieving a minimum CMMC level of 1.
• The CMMC model will be agile enough to adapt to emerging cyber threats in the DIB sector. A neutral 3rd party will maintain the standard for the Department.
• The CMMC includes a center for cybersecurity education and training.
• The intent is for certified independent 3rd party organizations (C3PAO) to conduct CMMC audits and inform on DIB risk.
• The DoD developed a CMMC tool for third-party certifiers to use during audits. The tool collects metrics and informs the DoD on risk mitigation for the entire supply chain.

Certification assessment, we should better understand DFARS and NIST SP 800-171.

The DoD is taking the process of securing the Defense Industrial Base (DIB) even more seriously than they already were. However, implementation can be challenging for small-to-medium size businesses. That said, it doesn’t have to be. Praetorian Secure has vast experience working with companies to achieve CMMC and NIST Compliance. We can navigate the difficulties with your team and transfer knowledge about the best course for implementing Cybersecurity Maturity Model requirements and certification. The benefits of working together result in reduced transition-in costs and timelines to meet your contract commitments.

What is at stake with CMMC Compliance? Our national security. Hackers with malicious intent, potentially against the United States of America, want (and are getting) data to our defense systems.

The passage of the DFARS general rule in December 2020 allowed the DOD to introduce CMMC and solidify its importance in DOD contracts. CMMC level 2 is based on NIST 800-171, which specified the cyber security standards for Defense Industry Base (DIB) contractors handling CUI before the deployment of CMMC. Contractors can still refer to DFARS clause 252.204-7012 for guidance on self-assessing their cyber security capabilities until CMMC is officially required.

With the addition of DFARS 252.204-7019, which requires contractors to upload a self-assessment score, at a basic level, to the Supplier Performance Risk System (SPRS), accountability and accuracy by the contractor are far more critical than in the past. Contractors must also meet all 110 security controls in NIST SP 800-171 or provide a Plan of Action and Milestones (POAM) indicating their plan. A POAM describes the measures a DIB contractor will take to correct the deficiencies discovered during a security control assessment. This plan should identify the tasks the contractor needs to perform in addition to the resources those tasks will require. The shift from self-assessments to independent audits for cyber security compliance is one of the most significant differences between NIST 800-171 and CMMC.

Third-Party Assessors will now conduct assessments for most organizations that require Level 2 compliance, which won’t accept non-compliance with DOD cybersecurity regulations. Under NIST 800-171, non-compliance was acceptable, provided the contractor prepared a POA&M and made progress in closing their remaining gaps. CMMC and NIST SP 800-171 mandates will continue to coexist until the DOD completes the CMMC roll-out according to its existing timeline. The number of DoD contractors subject to CMMC will gradually increase over the next few years to include all these contractors, while the number of defense contractors still subject to NIST SP 800-171 will eventually drop to zero.