<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

DFARS

What is the Cybersecurity Maturity Model Certification

down-arrow

Created In Response to the Evolving Threat Landscape

The United States’ Department of Defense (DoD) supply chain is one of the most critical to both national security as well as the protection of the individuals in the armed forces. Regardless of where contractors sit in that supply chain, security is critical to avoid intellectual property theft or worse sabotage from bad actors.

With the rise of digital technologies and information systems that many contractors have embraced to increase efficiency and enable business growth has come new cyber threats. The DFARS clause that went into effect in 2018 was the DoD’s first stake in the ground, indicating that members of the defense industrial base (DIB) must be held to a standard of security to protect the nation. The self-certification process proved too unwieldy to track and verify.

Recognizing that there needed to be more structure than the self-certification of compliance with NIST SP 800-171, the Department of Defense began developing what would become the Cybersecurity Maturity Model Certification (CMMC).

What Is CMMC Compliance?

In developing the CMMC, the DoD recognized that not all contractors have the bandwidth to develop security programs on par with a prime and nor should they have to. Recognizing that contractors’ security should be dependant on the form and caliber of controlled unclassified information (CUI) that they are working with, the CMMC is a tiered model. Ranging from Tier 1 (Basic Cyber Hygiene) to Tier 5 (Advanced/Progressive), these maturity levels are designed to enable vendors to meet the requirements necessary for good cyber hygiene with the dod contracts they are bidding for rather than having to invest in unnecessary requirements meant for a higher bid.

The CMMC has been developed in partnership with academia (Johns Hopkins and Carnegie Mellon) and industry leaders in the form of a listening tour and draws from a library of standards and frameworks, including NIST SP 800-171 and the NIST Cybersecurity Framework.

The Cybersecurity Maturity Model Certification introduces new terminology to classify what most information security practitioners will recognize as categories, control families, and security controls. In the CMMC, one will recognize what are called “Domains” as categories and subcategories from NIST SP 800-53 for protecting CUI:

From there, each Domain has a collection of “Capabilities” that bear resemblance to control families in other frameworks like SP 800-171 and the CSF. Finally, the capabilities have specific “Practices and Processes” associated with them and security leaders can see these as more granular controls.

Tips to Proactively Meet The CMMC

For most vendors, the CMMC levels are the biggest concern. Given that they are the heart of the certification, the tiers are critical to proactively meeting the CMMC requirements. The Tier-level certification requirements for a given contract will be included in the RFI and subsequent RFP.

From our intel in the field, we have been able to glean that most contract requirements in the supply chain will fall in Tier 3 and below. Primes will be responsible for achieving Tier 4 and 5 certification levels and cybersecurity practices.

Our recommendation to proactive defense contractors is to start working towards Tier 3 compliance. Based on the timeline given Office of the Under Secretary of Defense for

Acquisition & Sustainment, we anticipate that Tier 3 and below are at least in their semi-final (if not final) stages and contractors can start working towards the requirements.

We have good news if you are pursuing Tier 3 compliance - if you have used CyberStrong to achieve DFARS compliance, we have identified only 19 Processes/Practices (controls) that are referenced from frameworks outside of NIST SP 800-171. We also support Tier 3 Processes and Practices in CyberStrong and cmmc audits.

Why leading DoD contractors and prime contractors are choosing CyberStrong:

 

 

 

You may also like

How Putting Risk First in ...
on June 8, 2021

Risk management has developed significantly from when it was first introduced. In the 16th and 17th centuries, notions of risk management evolved into something more akin to how ...

Kyndall Elliott
State of Play: How Cyber and IT ...
on June 9, 2021

It’s common for companies to hoard their knowledge like a dragon with gold. Especially in competitive marketplaces, no one corporation wants to give their opponent an advantage ...

Kyndall Elliott
Why the FAIR Model is the Next ...
on May 18, 2021

With the recent Colonial Pipeline attack, risk and risk quantification is on everyone’s minds. However, quantifying risk is often not an easy thing. There are so many factors that ...

Kyndall Elliott
Top Business Stakeholder ...
on May 25, 2021

It can often feel like a cultural divide exists between security teams and the rest of the company. COVID-19 disrupted every day-to-day services for many enterprises, overloading ...

Kyndall Elliott
The Top 4 Risks of Cloud Computing ...
on May 12, 2021

The global pace at which technology is evolving and accelerating is incredible. People and companies are becoming less concerned with having “physical” assets or solutions. Tom ...

Kyndall Elliott
Going Beyond Cloud Security ...
on May 7, 2021

Modern businesses have been migrating to the cloud in droves throughout the pandemic. It was a necessity in order to secure remote work during COVID-19, but as cloud service ...

Kyndall Elliott