Comprehensive Guide to CMMC Compliance Consulting

Achieving CMMC 2.0 compliance is not a one-off thing. It is a progressive and systematic process of implementing best cybersecurity practices specified in NIST SP 800-171 and elsewhere. So, if you are wondering how do I become CMMC 2.0 compliant, below is a CMMC compliance checklist: 

Identify your CMMC compliance level

What type of government data do you handle or will handle? This is a critical question to ask yourself as it determines the CMMC level at which you should achieve compliance. However, every DoD contractor or subcontractor must achieve a CMMC level 1 compliance. However, a level 2 or level 3 certification is required if your business handles CUI.

Select the Project Lead (OSC Assessment Official)

Upon determining the maturity level you need compliance at, you will need to appoint or identify a CMMC lead within your organization. Additionally, you should give the lead the required executive support. The OSC Assessment Official will champion the projects and work with outside consultants where necessary. However, the OSC Assessment Official should develop or have a high-level understanding of CMMC requirements. In larger organizations, these responsibilities may be assigned to a dedicated small team. However, the best practice when assigning members to that team is to do it alongside the CMMC 2.0 practice areas.

Optimize CUI interaction

Understanding how CUI interacts with your environment is critical as it impacts compliance costs. Therefore, you should identify the touchpoints between your systems and CUI – from that moment it enters your environment to its processing, storage, use, and eventual exit. Upon identifying these touchpoints, you can then work towards minimizing CUI interactions. This helps reduce the scope of CMMC compliance requirements. Doing this helps you save on costs and improve your overall compliance posture.

Limit CUI access

The next step towards CMMC compliance is reducing the number of employees or individuals with access to CUI. This streamlines the compliance process and reduces unnecessary compliance overheads. Limiting access will greatly reduce the need for extensive training and costly licensing. 

Choose the right CUI protection technologies

CMMC compliance also requires that you choose the right technologies. For instance, you should use compliant CUI processing, storage, marking, and transmission technologies. Go for FIPS-validated cryptographic modules and hardware and store CUI in FedRAMP moderate baseline Cloud environments.

Implement required security practices

To achieve CMMC compliance, reviewing and improving your organization’s policies, procedures, and technologies is essential. This will help ensure you meet the requirements and maintain the highest cybersecurity standards.

Consult a certified RP to help determine your score

The best and easiest way to achieve CMMC compliance is by working with seasoned professionals – CMMC RPs who have helped OSCs achieve compliance. They can help you get the documentation organized and implement technology. An RP will help reduce any compliance gaps in your environment. They might even catch something you could have missed or address the unclear things on your SSP. If your RP encounters any obstacles, you must address the security gaps identified. This may require engaging the services of a managed service provider (MSP) to help mitigate these risks, particularly if your internal capabilities are limited.

Prepare and maintain Your System Security Plan (SSP)

You should note that having all compliance practices in place isn’t sufficient to achieve certification. You also should ensure that your documentation is accurate and up-to-date. All level 3 and some level 2 certification requirements need to be validated by a third-party assessor. Hence, you must prepare a detailed SSP that outlines how each security control is used.

Conduct a self-assessment against NIST 800-171A

Now that you have a clear target, you will want to determine where your system currently stands—conducting a self-assessment against NIST 800-171A. This publication has 320 objectives that map to NIST SP 800-171’s 110 security controls. Every control can have multiple objectives, and a contractor must meet them ALL to satisfy it. This means that organizations seeking level 2 or level 3 certification should conduct self-assessments against all the NIST 800-171A’s 320 objectives. However, organizations seeking certification at level 1 only need to self-assess against the required 17 controls. Each of the 110 controls in NIST 800-171 is assigned a weighted score of 1, 3, or 5 points. This results in possible scores for NIST 800-171 ranging from -203 (indicating no controls satisfied) to +110 (indicating all controls met).

Develop a Plan of Action and Milestones (POA&Ms)

An OSC might be unable to implement all the NIST SP 800-171 110 controls. Fortunately, CMMC 2.0 allows time-limited POA&Ms for any unimplemented controls. Sometimes, the OSC may also have implemented a practice but have yet to document it properly. In such an instance, they can arrange those practices in a Limited Practice Deficiency Correction document. Creating a POA&M can help the OSC plan for resource and technology upgrades. It is worth noting that POA&M are only allowed for 180 days, and only low-severity practices can be included.

Close security gaps 

Upon identifying the unmet controls, the OSC should take the necessary actions to implement the controls. Remember that POA&Ms are time-bound and expire within 180 days after a C3PAO assessment. Entities must prioritize addressing security gaps identified during the self-assessment or gap analysis.

Enlist an RPO or an accredited C3PAO to conduct final checks

Just before the Assessment by a C3PAO, you can optionally hire outside help to conduct final checks. You can work with a trained and certified C3PAO or RPO. RPOs are compliance experts and help OSCs in their certification efforts. However, some C3PAOs also act as RPOs to help the OSCs prepare for the third-party Assessment. However, due to a potential conflict of interest, you can’t hire the same C3PAO to prepare you for the Assessment and conduct the third-party Assessment. The final check ensures that an OSC is adequately prepared for the Assessment and they have the required evidence.

Arrange an assessment with an accredited C3PAO

Finally, you’ll need to enlist a certified and Accredited third-party assessor to conduct the Assessment. They will use interviews, tests, and examination techniques during the Assessment. For the OSC to pass the Assessment, the evidence adduced must pass the adequacy and sufficiency tests. Accredited C3PAOs can be found on the Cyber AB Marketplace. After completing the Assessment, the CMMC Quality Assurance Professional (CQAP) verifies that assessment documentation is complete and accurate before being uploaded to the CMMC eMASS.