Day in the Life of a CMMC 2.0 Consultant

The consultant’s first task is to evaluate the client’s current cybersecurity measures against the CMMC requirements. This includes reviewing the client’s policies, procedures, and technical controls. Based on this evaluation, the consultant will create a compliance plan that outlines the steps the client needs to take to achieve compliance.

Here are just a few compliance documents each CMMC consultant completes for each client:

• CMMC Assessment Guide: This guide provides detailed information on the CMMC model, including the process for conducting a CMMC assessment.
• CMMC Model: This document outlines the various maturity levels and domains required for CMMC compliance.
• System Security Plan (SSP): This document provides a detailed description of the client’s system and how it is secured.
• Plan of Actions and Milestones (POA&M): This document identifies any deficiencies in the client’s security posture and outlines steps to remediate them.
• Policies and Procedures: This set of documents provides guidelines and instructions for the client’s security practices.
• Evidence Collection Plan (ECP): This plan outlines the evidence that the consultant will need to collect during the assessment process.
• Assessment Results: This document summarizes the results of the CMMC assessment, including any gaps or deficiencies identified during the assessment process.

During the compliance process, the consultant will work with the client to implement the necessary changes. This can include implementing new technical controls, updating policies and procedures, and training employees on proper cybersecurity practices.

The consultant will also be responsible for conducting CMMC assessments to ensure that the client’s cybersecurity measures meet the necessary requirements. These assessments involve reviewing documentation, interviewing personnel, and testing technical controls. Once the client has achieved compliance, the consultant will help them maintain compliance through regular assessments and updates to policies and procedures. They will also monitor for any changes to the CMMC framework and make recommendations for updates to the client’s cybersecurity measures. CMMC 2.0 consultants must have a deep understanding of the NIST 800-171 framework, which is the foundation for CMMC compliance. The consultant must also have a strong knowledge of CUI and DFARS, which mandates CMMC compliance for all DoD contractors.