About CMMC

Cybersecurity Maturity Model Certification

CMMC model structure: Cybersecurity maturity across five levels

Source: Office of the Under Secretary of Defense for Acquisition & Sustainment, CMMC Model v1.0 Briefing, January 31, 2020.

The Cybersecurity Maturity Model Certification (CMMC) is a new requirement for existing DoD contractors, replacing the self-attestation model and moving to third-party certification.

The certification will be built on existing requirements such as NIST SP 800-171, NIST SP 800-53, AIA NAS9933, private sector contributions, and input from academia. This new certification is intended to tighten cybersecurity within the defense industrial base. CMMC consists of five levels to measure cybersecurity practices of contractors.

Start your Certification Assistant Trial Start your Exostar PolicyPro Trial

Frequently Asked CMMC Questions

For reference, click here for the most current CMMC Model: v1.02 (released March 2020).

What is CMMC?
CMMC stands for “Cybersecurity Maturity Model Certification”. The CMMC will encompass multiple maturity levels that ranges from “Basic Cybersecurity Hygiene” to “Advanced”. The intent is to identify the required CMMC level in RFP sections L and M and use as a “go / no go decision.”

Why is CMMC being created?
DOD is planning to migrate to the new CMMC framework in order to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC is intended to serve as a verification mechanism to ensure appropriate levels of cybersecurity controls and processes are adequate and in place to protect controlled unclassified information (CUI) that resides on the Department’s industry partners’ networks.

How can my organization become certified?
Your organization will coordinate directly with an accredited and independent third party commercial certification organization to request and schedule your CMMC assessment. Your company will specify the level of the certification requested based on your company’s specific business requirements. Your company will be awarded certification at the appropriate CMMC level upon demonstrating the appropriate maturity in capabilities and organizational maturity to the satisfaction of the assessor and certifier.

How do I request certification assessment?
We expect that there will be a number of companies providing 3rd party CMMC assessment and certification.

I am a subcontractor on a DoD contract. Do I need to be certified?
Yes, all companies doing business with the Department of Defense will need to obtain CMMC.

How often does my Organization need to be reassessed?
The duration of a certification is still under consideration.

Exostar CMMC Solutions

Partner Information Manager (PIM): Reduce risk while simplifying challenges managing and securing complex partner and supplier networks.

Certification Assistant: Manage risk and streamline the Department of Defense certification process.

ForumPass Defense: Protect documents inside and outside your organization with a secure and intuitive platform. 

Exostar PolicyPro: Build and maintain security policies more easily, and in line with NIST 800-171 and CMMC standards.

Source: Office of the Under Secretary of Defense for Acquisition & Sustainment, CMMC Model v1.0 Briefing, January 31, 2020.

Additional CMMC Resources

Prior CMMC Releases

CMMC V1.02 – Released March 2020
CMMC v1.0 – Released Jan 2020

Articles
What is CMMC and Why is it Essential?
The Verdict is In: Self-Attestation it Out.
Why security can’t be the Fourth Procurement Pillar

Links
Infographic: Top 5 Concerns about Securing the DoD Supply Chain
WEBINAR (On-Demand): CMMC Documentation and Policy Requirements
Video: A Contractor’s Guide – Navigating the Coexistence of NIST 800-171 & CMMC
Cybersecurity Maturity Model Certification: Office of the Under Secretary for Acquisition & Sustainment
FAQs
CMMC V.1 brief
CMMC model: Complete framework

Roadmap to Meeting NIST 800-171 Requirements

Download this free infographic roadmap now.

Download Free

Suppliers Guide to CMMC

Download this free informational guide now.

Download Free

Cybersecurity Executive Order

Issued May 21, 2021

Read Here

DFARS Interim Rule

Effective 11/30/2020

Read The Rule

Recent CMMC Updates

DoD CMMC Assessment Guide: Level 3 (PDF) – pub Nov 2020

DoD CUI Registry (PDF) – pub Sept 2020

DoD CUI Registry (Excel) – pub Sept 2020

DFARS Interim CMMC Rule – Released Sept 2020

DCMA Updates NIST SP 800-171 Assessment Methodology to Include Virtual Assessments (July 2020)

 

CMMC Levels

Level 1

  • Process: At this level, practices are performed in an ad-hoc manner so there is no process requirement.
  • Practice: It addresses protection of FCI and 17 practices are required for the basic safeguarding requirements specified in 48 CFR 52.204.21.

Level 2

  • Process: Policy and documentation of practice are required to develop mature capabilities and achieve process Level 2.
  • Practice: Progression from Level 2 to Level 3. The majority of practices (65 of 72) comes from NIST SP 800-171 and new 7 practices from other standards are added to Level 2, such as audit log review, event detection/reporting, analyzing triaging events, incident response, Incident RCA (root cause analysis), regular data backup and testing, and encrypted session for device mgmt..

Level 3

  • Process: Not just policy and documentation of practices, a plan is required to demonstrate management of practice implementation activities. The plan needs to address missions, goals, project plans, resourcing, required training and involvement of stakeholders.
  • Practice: All 110 control requirements of NIST SP 800-171 are required for this level. In addition, 13 new practices from other standards are added to Level 3, such as defining procedures of CUI data handling, collecting audit info into central repositories, regular data backups, periodical risk assessment, risk mitigation plan, separate management of non-vendor-supported products, security assessment of enterprise software, cyber threat intel response plan, DNS filtering, restriction of CUI publication, spam protection mechanisms, email forgery protections, and sandboxing.

Level 4

  • Process: Practices are reviewed and measured for effectiveness. In addition, correct actions when necessary and communication to higher level mgmt. on a recurring basis are required.
  • Practice: In order to protect CUI from APTs, 26 practices enhance the detection and response capabilities to address and adapt to TTPs used by APTs.

Level 5

  • Process: Process standardization and optimization.
  • Practice: The additional 15 practices increase the depth and sophistication of cybersecurity capabilities.