Everything You Need To Know About
Cybersecurity Maturity Model Certification (CMMC)
 |
| Everything You Need To Know About Cybersecurity Maturity Model Certification (CMMC) |
The Department of Defense (DoD) of
the United States has proactively measured and issued certain guidelines in the
creation of the Cybersecurity Maturity Model Certification (CMMC). This is to
up the standards of cybersecurity in the defense industrial base (DIB) of the
government. The CMMC is soon to be implemented and will be a requirement for
the contractors/vendors of defense who wish to work with the DoD.
Cybersecurity is a
serious issue, as the federal data/information is subjected to constant
threats. Hence, the CMMC is required to safeguard the Controlled Unclassified
Information (CUI) and Federal Contract Information (FCI) across the chain of
supply of DoD. DoD defines CUI as the data which the government/
government-affiliated entity creates or possesses. This data or information can
be about the legal or financial dealings, intelligence, or about the
infrastructural data inputs, controls of exports, or other various data.
Hence, it becomes imminent for the
contractors or vendors of DoD to learn about the CMMC compliance requirements. This will help them to ascertain
that they are updated about the certification measures and will prepare the
concerned contractor with a long-term effective cybersecurity.
What Is CMMC Compliance?
As explained above, the main aim of
this certification is to ensure the surety and safety of CUI across the DoD
chain. The framework of CMMS will imbibe the active process and practice to
standardize the evaluation of the capability of the DoD contractors.
The CMMC certification requirements
extensively depend on the certification levels. Every level of certification
will cover the needed procedures of the level which precedes it. Hence, on a third level, one needs to take care that level 2 and 1 certification is complete.
The Certification Levels Are As Follows:
Level 1:
“Basic Cyber Hygiene”
If the DoD vendors want to clear the
first level audit, they should, without fail, implement 17 controls of the NIST
800-171 rev1.
Level 2:
"Intermediate Cyber Hygiene”
At the second level of certification,
the vendors of DoD should implement another 48 controls of NIST 800-171 rev1,
including seven new "Other" controls.
Level 3:
In this level of certification, the
DoD contractors need to positively implement the final 45 controls of NIST
800-171 Rev1 along with 13 new "Other" controls.
Level 4:
Keeping up the requirements of the
previous three levels, the DoD contractors should implement another 11 controls
of NIST 800-171 Rev2 along with 15 new “Other” controls.
Level 5:
“Advanced / Progressive”
cybersecurity
This is the final level of
certification, in which the certification of the previous level needs to be
met. The last four controls in NIST 800-171 Rev2, along with 11 new “Other" controls, should be implemented.
In the completion of every
certification level, the DoD vendors need to complete the process that is
incorporated in that particular level that spans across 43 capabilities
embedded in 17 domains.
The 17
Capability Domains In The CMMC Model Are:
Access Control (AC)
Risk Management (RM)
Incident Response (IR)
Asset Management (AM)
Security Assessment (CA)
Maintenance (MA)
Media Protection (MP)
Awareness and Training (AT)
Situational Awareness (SA)
Personnel Security (PS)
Audit and Accountability (AU)
System and Communications Protection
(SC)
Physical Protection (PE)
Configuration Management (CM)
System and Information Integrity (SI)
Recovery (RE)
Identification and Authentication
(IA)
When The CMMC Take Effect?
On January 31, 2020, the DoD
announced the CMMC program. It is in effect, and CMMC with active
implementation will be required of all DoD requests for proposals starting from
2026.
Whom Will The CMMC Program Apply?
Recap Of The CMMC Framework
Capabilities: 43
Practices: 171
Processes: Maturity Levels; varying
from levels 1 – 5
Certification Levels: 5
For the levels of maturity, the
assessment of processes will be required that also corresponds to the level of
certification. The various domains correspond to the practices, which are
further organized by capabilities (this encompasses the Processes). To achieve
a certain level of Certification, one needs to master the Domains incorporated
in that level, which also encompasses the Practices and Processes.
To Conclude:
The key takeaway from the CMMC
compliance is that it is a progressive model that will cover the advanced
levels of cybersecurity. The documented processes and consistent practices
associated with each level will help maintain cyber hygiene. Cybercrime is
known to infect and drain a major portion of the global GDP. In lieu of this,
the Department of Defense (DoD) has issued the CMMC program to provide a
respite to the contractors or vendors from the illicit cybercrime.