CMMC Explained: What Defense Contractors Need to Know

As a security certification, CMMC is soon to be put in place for Defense Industrial Base companies as a data protection requirement. Although the Department of Defense (DoD) is actively working on finding new ways to protect data and prevent cybersecurity incidents, hackers are working on the other side to make their breaches unstoppable. As a result, defense contractors will have to comply with a new set of security rules known as the CMMC security framework.

What is CMMC

CMMC is short for the Cybersecurity Maturity Model Certification and it represents a security standard for implementing protective measures across the defense industrial base. The said base counts over 300 000 companies in its supply chain, which have suffered numerous security breaches up until now. These events prompted the DoD to create a better cybersecurity framework as a response to recent compromises of sensitive data within the contractors’ information systems.

The US Department of Defense officially released the CMMC framework on January 31st, 2020. Before CMMC was a thing, contractors were responsible for doing their own work in terms of implementing and monitoring the security of their information systems.

While they are still in charge of maintaining critical cybersecurity measures and meeting set requirements, defense contractors now have to comply with another set of mandatory practices that will evolve their cybersecurity measures. In other words, the CMMC gives contractors a set of new technical requirements they ought to meet in order to protect their information systems from potential cybersecurity attacks.

With that said, defense contractors have to prepare not only for the CMMC certification but also on the long-term security practices they must start implementing. CMMC assessments will be conducted to determine whether DoD contractors are meeting the mandatory CMMC requirements in each of their upcoming projects.

Who Must Comply with the CMMC

Most simply put, all DoD contractors will eventually have to obtain a CMMC certification, meaning they will have to go all the way through with following the framework’s requirements. By all DoD contractors, we are referring to suppliers at all tiers of the supply chain, commercial item contractors, small businesses, and foreign suppliers as well. The CMMC Accreditation Body was put in place to communicate directly with DoD contractors to ensure they are meeting all the requirements necessary for obtaining the certification.

The CMMC Framework Certification Levels

The CMMC framework is structured in such a way that it has five different certification levels. Each level shows how reliable the company’s cybersecurity infrastructure it is in terms of protecting sensitive data from potential cyber threats. Naturally, the companies’ goal should be to obtain the highest level of the CMMC certification for the sake of protecting data and building a positive reputation.

Each of the five levels of certification comes with different technical requirements. Consequently, it is far more difficult to achieve the 4^th or 5^th level of certification compared to the 1^st or 2^nd levels. Here’s a brief overview of each of the 5 CMMC framework levels:

1. Level 1 requires a company to perform the basic cybersecurity measures such as ensuring proper password management, using an antivirus program, and raining their employees to manage basic security tasks.
2. At Level 2, a company must start documenting intermediate cybersecurity measures to protect Controlled Unclassified Information or CUI. At this level, companies must implement the NIST framework’s security requirements.
3. In order to obtain a Level 3 certification, a company must put together an institutionalized management plan that implements relevant cybersecurity measures. This includes having a plan that safeguards CUI and includes all the NIST security requirements, next to other standards.
4. At Level 4, the company has to finish the implementation of all procedures designed to measure and review their security practices put in place to protect against advanced persistent threats.
5. Lastly, to obtain a Level 5 certification, a company must put continuous effort into detecting and responding to ATPs in the most efficient way possible. A company that has a Level 5 CMMC certification is considered fully reliable and trustworthy in terms of being able to safeguard their sensitive information systems and processes.

Conclusion

Over 300 000 DoD contractors will have to obtain the CMMC certification in order to take the DIB’s data security to the next level. Without the CMMC certification, competing for DoD contracts will soon become impossible. Thus, companies should start preparing for assessment procedures by implementing the basic cybersecurity measures and working their way up the ladder.

A few steps to start the preparation include clearly documenting the required practices and procedures, as well as building an actionable plan as to how to start implementing those procedures. Naturally, DoD contractors should aim to obtain the highest level of certification possible to remain competitive in this industry.