Search for:
  • Advisory
  • Assurance
  • Tax
  • Strategic Alliances
Services

Cybersecurity Maturity Model Certification

Are You Ready for CMMC Compliance Requirements?

The Cybersecurity Maturity Model Certification (“CMMC”) is a unified cybersecurity standard for Department of Defense (“DoD”) acquisitions, aimed at securing the Defense Industrial Base (“DIB”) supply chain. This standard was updated in November of 2021 and is now considered “CMMC 2.0”.

The CMMC Program proposed final rule (32 CFR Part 170) was published in the Federal Register on December 26, 2023, for public comment. The public comment period ended on February 26, 2024. Currently, the public comments are being adjudicated by the DoD with a final review by the Office of Information and Regulatory Affairs (OIRA) expected before the rule goes into effect. It is expected that once the CMMC Program proposed rule is in effect authorized C3PAOs will be able to conduct Level 2 CMMC Assessments.

Why is CMMC important?

CMMC is important to Safeguard sensitive DIB supply chain information, enforce DIB cybersecurity standards to meet evolving cybersecurity threat, ensure accountability while minimizing barriers to compliance with DoD requirements, perpetuate a culture of cybersecurity and cyber resilience throughout the DIB Supply Chain and maintain public trust.

CMMC is not only applicable to contractors as part of the DIB, but it also affects subcontractors to prime DIB Contractors. In short, if you are selling directly to the DoD, or are supporting a contractor that is selling directly to the DoD, you can expect that CMMC requirements will flow down to your organization. If you don’t meet those requirements, it could have a direct impact to your bottom line.

What are the CMMC levels?

CMMC is a DoD program aimed at securing the DIB supply chain by increasing the protection of controlled unclassified information (CUI) and federal contract information (FCI) within the DIB.

CMMC compliance consists of three levels that organizations need to comply with, drive the number of controls the organization needs to comply with, and define the frequency in which a self-assessment or if an independent third-party certification by an accredited organization will be required.

  • CMMC Level 1 – Organizations handling and needing to protect Basic safeguarding of FCI
  • CMMC Level 2 – Organizations handling and needing to protect CUI
  • CMMC Level 3 – Organizations needing to safeguard CUI and subject to Advanced Persistent Threats (APT)

What are the proposed DoD DFARS amendments?

The DoD proposed amendments to the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate CMMC 2.0 requirements into defense contracts. Published in August 2024, these changes highlight the DoD’s commitment to strengthening cybersecurity across its supply chain, reflecting broader efforts to protect sensitive information within the DIB.

Key Aspects of the Proposal include:

  • Certification at Contract Award: Contractors must hold the appropriate CMMC certification level at the time of the contract award and maintain it throughout the contract’s duration.
  • Flow-Down Requirements: The CMMC requirements must be extended to all subcontractors handling FCI or CUI.
  • Continuous Compliance: Contractors are required to annually affirm their compliance with the CMMC level applicable to the systems used in contract performance, with updates required if any changes occur.
  • Phased Implementation: The proposed rules will be rolled out over three years, with selective implementation initially, becoming mandatory for all relevant contracts by the fourth year.

The proposed DFARS rule will impact certain contracts during a phased-in, three-year implementation period. Afterwards, the requirements will apply to all contracts for which the contractor will process, store, or transmit FCI or CUI on contractor information systems. During the first three years of the phased rollout, the CMMC requirement will be included only in certain contracts for which the CMMC Program Officer directs DoD component program offices to include a CMMC requirement. After three years, DoD Component program offices will be required to include a requirement for CMMC in solicitations and contracts that will require the contractor to process, store, or transmit FCI or CUI on contractor information systems.

The below table outlines DoD’s four implementation phases.

Phase

Summary

Timeline

Phase 1

  • The DoD intends to include CMMC Level 1 or CMMC Level 2 Self-Assessments for all applicable DoD solicitations and contracts as a condition of contract award.
  • The DoD may include:
    • CMMC Level 1 or CMMC Level 2 Self-Assessments for applicable DoD solicitations and contracts as a condition to exercise an option period on a contract awarded prior to the effective date of DFARS 7021.
    • CMMC Level 2 Certification Assessment in place of CMMC Level 2 Self-Assessment for applicable DoD solicitations and contracts.

Begins on the effective date of the CMMC revision to DFARS 7021.

Phase 2

  • The DoD intends to include CMMC Level 2 Certification Assessment (requires a C3PAO) for all applicable DoD solicitations and contracts as a condition of contract award.
  • The DoD may:
    • Delay the inclusion of CMMC Level 2 Certification Assessment to an option period instead of as a condition of contract award.
    • Include CMMC Level 3 Certification Assessment for applicable DoD solicitations and contracts.

Begins six months following the start date of Phase 1.

Phase 3

  • CMMC Level 2 Certification Assessment (requires a C3PAO) for all applicable DoD solicitations and contracts as a condition of contract award and as a condition to exercise an option period on a contract awarded prior to the effective date of DFARS 7021.
  • CMMC Level 3 Certification Assessment requirements included for all applicable DoD solicitations and contracts as a condition of contract award.

Beings one calendar year following the start of Phase 2.

Phase 4

  • Full Implementation: The DoD will include CMMC Program requirements in all applicable DoD solicitations and contracts, including option periods on contracts awarded prior to the beginning of Phase 4.

Begins one calendar year following the start date of Phase 3.

Cherry Bekaert – Your Full Service CMMC Provider

Cherry Bekaert is a full service, start-to-finish CMMC provider, able to assist your organization with CMMC compliance gap assessments, provide oversight and management of remediation and reporting efforts, and can certify your organization in our role as an authorized CMMC Third-Party Assessment Organization (C3PAO) and certified Registered Provider Organization (RPO).

Our team is composed of CMMC certified practitioners and brings to your CMMC efforts consultative professionals with IT and cybersecurity leadership experience, so you can be assured that we drive practical and pragmatic recommendations and solutions to your team.

CMMC Compliance Gap Assessments

Gap assessments are crucial in making sure there is a clear understanding of their current state of compliance against CMMC.

Our CMMC compliance gap assessments are designed to assist management in understanding the scope and extent of the organization’s CMMC compliance needs.

At the end of our gap assessment, we provide to you a CMMC compliance roadmap that includes practical and pragmatic recommendations for CMMC remediation for the organization, so you have a clear plan going forward for your organization.

CMMC Compliance Advisory Services

Once a clear view of gaps in CMMC compliance has been developed, our team of CMMC compliance advisory professionals will work with you as a trusted compliance advisor that can assist your organization with remediating gaps and driving the implementation of a CMMC Program tailored to your organization. We assist many organizations with crucial components of the CMMC program, including:

  • Scope and boundary identification and definition
  • Asset identification and categorization
  • System security plan development
  • Shared responsibility matrix development
  • Policy and procedure development
  • Alignment with/leveraging other compliance initiatives and efforts (where appropriate)
  • Vendor and third-party selection and compliance (i.e., FedRAMP Moderate and CMMC requirements for CSPs and ESPs)

In addition, we can fully support your self-assessment efforts to make sure that all necessary program parameters are in place before being signed by an appropriate organizational executive.

CMMC Certifications & Attestations

Our CMMC assessments are streamlined from planning and testing though reporting and submission to ensure an efficient assessment from beginning to end.

Cherry Bekaert follows a proven assessment process that includes the following phases:

  • Plan and prepare the assessment
    • Establish roles and responsibilities
    • Validate CMMC assessment scope
    • Verify readiness to conduct the assessment
  • Conduct the assessment
    • Collect and examine evidence
    • Conduct interviews
    • Determine FedRAMP Moderate Equivalency for Cloud Service Providers (CSPs)
    • Score OSC practices and validate preliminary results
  • Report recommended results
    • Deliver recommended assessment results
    • Submit, package, and archive assessment documentation
    • Upload assessment results into CMMC eMASS
    • Schedule a CMMC POA&M close-out assessment (if necessary)
  • Close-Out POA&Ms and assessment (if necessary)
    • Perform POA&M close-out assessment
    • Update POA&M close-out

In addition, Cherry Bekaert offers organizations the ability to undergo an attestation to the CMMC Level 1 and Level 2 Standard, NIST 800-171, for those looking for further assurance beyond just a self-assessment. These engagements can be performed individually or in conjunction with an existing SOC 2 audit, e.g., SOC 2+ NIST 800-171.

CMMC Third-Party Assessment Organization Authorization (C3PAO) and Registered Provider Organization (RPO)

Cherry Bekaert is an authorized C3PAO and certified RPO by the Cyber AB. We assist Organization’s Seeking Certification with CMMC readiness assessments for Levels 1, 2 and 3.

Additionally, as an authorized C3PAO, Cherry Bekaert partners with the Defense Contractor Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) under their Joint Surveillance audit program to perform DIBCAC High (NIST 800-171) Assessments which are convertible to CMMC Level 2 Certification if a perfect score is obtained.

Let's Talk

Kurt Manske

Leader, Information Assurance and Cybersecurity

Let's Talk

Steven J. Ursillo, Jr.

Steven J. Ursillo, Jr.

Partner, Attestation and Certifications Lead

Let's Talk

Neal W. Beggan

Neal W. Beggan

Partner, Risk & Accounting Advisory Services

Let's Talk

Related Thought Leadership
Aug 22
Alert

Recent DoD DFARS Amendments: What You Need to Know

Read More
play button
Jul 25
Webinar Recording

Getting Ahead of CMMC Compliance: Latest Insights & How to Prepar...

Watch Now
Jan 04
Podcast

CMMC Program Proposed Rule Published in the Federal Register: Insights...

Learn More
Aug 01
Podcast

Final CMMC Rule Reaches Critical Milestone

Learn More
Jun 14
Podcast

How Will NIST Special Publication (SP) 800-171, Revision 3 Impact CMMC...

Learn More
Mar 17
Article

Updated Projected Timeline for CMMC: What this Means for Contractors a...

Learn More
Related Services

Cybersecurity

Cherry Bekaert’s specialists can identify an organization’s cybersecurity risks, and develop realistic solutions to help...

Learn More

Government Contractor Consulting Services

Cherry Bekaert’s Government Contractor Consulting Services team offers innovative and tailored solutions to help address...

Learn More

Risk & Accounting Advisory

Cherry Bekaert helps organizations manage unforeseen and emerging risks through the Firm’s risk assessment, internal...

Learn More

Financial Services

Learn about our financial risk management consulting services and learn why financial consultancy is vital...

Learn More

Contact Our CMMC Professionals