Are You Ready for CMMC Compliance Requirements?
The Cybersecurity Maturity Model Certification (“CMMC”) is a unified cybersecurity standard for Department of Defense (“DoD”) acquisitions, aimed at securing the Defense Industrial Base (“DIB”) supply chain. This standard was updated in November of 2021 and is now considered “CMMC 2.0”.
The CMMC Program proposed final rule (32 CFR Part 170) was published in the Federal Register on December 26, 2023, for public comment. The public comment period ended on February 26, 2024. Currently, the public comments are being adjudicated by the DoD with a final review by the Office of Information and Regulatory Affairs (OIRA) expected before the rule goes into effect. It is expected that once the CMMC Program proposed rule is in effect authorized C3PAOs will be able to conduct Level 2 CMMC Assessments.
Why is CMMC important?
CMMC is important to Safeguard sensitive DIB supply chain information, enforce DIB cybersecurity standards to meet evolving cybersecurity threat, ensure accountability while minimizing barriers to compliance with DoD requirements, perpetuate a culture of cybersecurity and cyber resilience throughout the DIB Supply Chain and maintain public trust.
CMMC is not only applicable to contractors as part of the DIB, but it also affects subcontractors to prime DIB Contractors. In short, if you are selling directly to the DoD, or are supporting a contractor that is selling directly to the DoD, you can expect that CMMC requirements will flow down to your organization. If you don’t meet those requirements, it could have a direct impact to your bottom line.
What are the CMMC levels?
CMMC is a DoD program aimed at securing the DIB supply chain by increasing the protection of controlled unclassified information (CUI) and federal contract information (FCI) within the DIB.
CMMC compliance consists of three levels that organizations need to comply with, drive the number of controls the organization needs to comply with, and define the frequency in which a self-assessment or if an independent third-party certification by an accredited organization will be required.
- CMMC Level 1 – Organizations handling and needing to protect Basic safeguarding of FCI
- CMMC Level 2 – Organizations handling and needing to protect CUI
- CMMC Level 3 – Organizations needing to safeguard CUI and subject to Advanced Persistent Threats (APT)
What are the proposed DoD DFARS amendments?
The DoD proposed amendments to the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate CMMC 2.0 requirements into defense contracts. Published in August 2024, these changes highlight the DoD’s commitment to strengthening cybersecurity across its supply chain, reflecting broader efforts to protect sensitive information within the DIB.
Key Aspects of the Proposal include:
- Certification at Contract Award: Contractors must hold the appropriate CMMC certification level at the time of the contract award and maintain it throughout the contract’s duration.
- Flow-Down Requirements: The CMMC requirements must be extended to all subcontractors handling FCI or CUI.
- Continuous Compliance: Contractors are required to annually affirm their compliance with the CMMC level applicable to the systems used in contract performance, with updates required if any changes occur.
- Phased Implementation: The proposed rules will be rolled out over three years, with selective implementation initially, becoming mandatory for all relevant contracts by the fourth year.
The proposed DFARS rule will impact certain contracts during a phased-in, three-year implementation period. Afterwards, the requirements will apply to all contracts for which the contractor will process, store, or transmit FCI or CUI on contractor information systems. During the first three years of the phased rollout, the CMMC requirement will be included only in certain contracts for which the CMMC Program Officer directs DoD component program offices to include a CMMC requirement. After three years, DoD Component program offices will be required to include a requirement for CMMC in solicitations and contracts that will require the contractor to process, store, or transmit FCI or CUI on contractor information systems.
The below table outlines DoD’s four implementation phases.
Phase |
Summary |
Timeline |
|
Phase 1 |
|
Begins on the effective date of the CMMC revision to DFARS 7021. |
|
Phase 2 |
|
Begins six months following the start date of Phase 1. |
|
Phase 3 |
|
Beings one calendar year following the start of Phase 2. |
|
Phase 4 |
|
Begins one calendar year following the start date of Phase 3. |
Cherry Bekaert – Your Full Service CMMC Provider
Cherry Bekaert is a full service, start-to-finish CMMC provider, able to assist your organization with CMMC compliance gap assessments, provide oversight and management of remediation and reporting efforts, and can certify your organization in our role as an authorized CMMC Third-Party Assessment Organization (C3PAO) and certified Registered Provider Organization (RPO).
Our team is composed of CMMC certified practitioners and brings to your CMMC efforts consultative professionals with IT and cybersecurity leadership experience, so you can be assured that we drive practical and pragmatic recommendations and solutions to your team.
CMMC Compliance Gap Assessments
Gap assessments are crucial in making sure there is a clear understanding of their current state of compliance against CMMC.
Our CMMC compliance gap assessments are designed to assist management in understanding the scope and extent of the organization’s CMMC compliance needs.
At the end of our gap assessment, we provide to you a CMMC compliance roadmap that includes practical and pragmatic recommendations for CMMC remediation for the organization, so you have a clear plan going forward for your organization.
CMMC Compliance Advisory Services
Once a clear view of gaps in CMMC compliance has been developed, our team of CMMC compliance advisory professionals will work with you as a trusted compliance advisor that can assist your organization with remediating gaps and driving the implementation of a CMMC Program tailored to your organization. We assist many organizations with crucial components of the CMMC program, including:
- Scope and boundary identification and definition
- Asset identification and categorization
- System security plan development
- Shared responsibility matrix development
- Policy and procedure development
- Alignment with/leveraging other compliance initiatives and efforts (where appropriate)
- Vendor and third-party selection and compliance (i.e., FedRAMP Moderate and CMMC requirements for CSPs and ESPs)
In addition, we can fully support your self-assessment efforts to make sure that all necessary program parameters are in place before being signed by an appropriate organizational executive.
CMMC Certifications & Attestations
Our CMMC assessments are streamlined from planning and testing though reporting and submission to ensure an efficient assessment from beginning to end.
Cherry Bekaert follows a proven assessment process that includes the following phases:
- Plan and prepare the assessment
- Establish roles and responsibilities
- Validate CMMC assessment scope
- Verify readiness to conduct the assessment
- Conduct the assessment
- Collect and examine evidence
- Conduct interviews
- Determine FedRAMP Moderate Equivalency for Cloud Service Providers (CSPs)
- Score OSC practices and validate preliminary results
- Report recommended results
- Deliver recommended assessment results
- Submit, package, and archive assessment documentation
- Upload assessment results into CMMC eMASS
- Schedule a CMMC POA&M close-out assessment (if necessary)
- Close-Out POA&Ms and assessment (if necessary)
- Perform POA&M close-out assessment
- Update POA&M close-out
In addition, Cherry Bekaert offers organizations the ability to undergo an attestation to the CMMC Level 1 and Level 2 Standard, NIST 800-171, for those looking for further assurance beyond just a self-assessment. These engagements can be performed individually or in conjunction with an existing SOC 2 audit, e.g., SOC 2+ NIST 800-171.
CMMC Third-Party Assessment Organization Authorization (C3PAO) and Registered Provider Organization (RPO)
Cherry Bekaert is an authorized C3PAO and certified RPO by the Cyber AB. We assist Organization’s Seeking Certification with CMMC readiness assessments for Levels 1, 2 and 3.
Additionally, as an authorized C3PAO, Cherry Bekaert partners with the Defense Contractor Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) under their Joint Surveillance audit program to perform DIBCAC High (NIST 800-171) Assessments which are convertible to CMMC Level 2 Certification if a perfect score is obtained.
