Introduction to CMMC Compliance
The Cybersecurity Maturity Model Certification (CMMC) is a cybersecurity framework designed to enhance the security posture of the Defense Industrial Base (DIB) and their supply chain. Developed by the Department of Defense (DoD), the CMMC ensures that contractors and subcontractors handling sensitive information have the appropriate cybersecurity measures in place.
The basic premise of the CMMC is to ensure that by 2025, all the DoD supply chain contractors and subcontractors, except for the providers of commercial-off-the-shelf products, should get a third-party certification for their proficiency in cybersecurity before embarking on the awarded contract.
Controlled Unclassified Information (CUI) refers to information that requires safeguarding or dissemination controls under federal regulations or government-wide policies. CUI is a result of Executive Order 13556, which aims to standardize the management and protection of unclassified information across federal agencies.
If you’re a research laboratory, university, corporation, or any other organization in the U.S. involved in manufacturing, exporting, or providing defense services, it’s crucial to register with the DDTC and comply with ITAR. Failure to do so could lead to severe penalties for unauthorized export of USML-listed items. With over 13,000 organizations dealing with defense technologies, compliance with ITAR is essential to safeguard sensitive data. To achieve ITAR compliance, learn about ITAR registration, secure storage and transmission of data are paramount and can be a key player in this process. To learn more about the International Traffic in Arms Regulations and how to become ITAR compliant, keep reading.
CMMC (Cybersecurity Maturity Model Certification) version 2.0 was released in November 2021 is an improvement of CMMC meant to simplify and streamline the certification process. CMMC 2.0 includes the new CMMC levels and the updated procedures and practices. It also establishes a more targeted approach towards safeguarding controlled unclassified information. However, many organizations in the Defense Industrial Base are still reviewing the guidelines to understand how they can adjust and remain in line with CMMC 2.0.
In 2007, ITT was fined $100 million for illegally exporting night vision technology. ITT thought that they could work around the imposed restrictions. However, the government didn’t agree with how they interpreted the rules. In April 2018, FLIR Systems was fined $30 million by the State Department for transferring USML data to employees holding dual nationalities. FLIR was also instructed to implement a better compliance strategy and hire a third party to oversee the agreement with Department as part of the penalty. Because of illegally exporting technical drawings of the missile, tanks, and aircraft components to countries like China, the State Department fined Honeywell International $13 million.
Does your company process, produce/manufacture, or repair various parts under USML for the Department of Defense? Or do you offer defense services or broker items controlled under the International Traffic in Arms Regulations (ITAR)? Then you are part of the Defense Industrial base (DIB). There are an estimated 350, 000+ companies in the DIB, with many in the precision metalwork industry. However, manufacturing on shop floor comprises many processes, from consulting, drafting, drawing, casting, and assembly, among many others.
Streamline Your NIST SP 800-171 Compliance with Our Assessment Template: A Comprehensive Guide to Evaluating and Enhancing Your Organization’s Cybersecurity Posture
The DoD’s current cybersecurity regulations are specified in the Defense Federal Acquisition Regulation Supplement (DFARS), released in 2015. DFARS required the defense contractors handling Controlled Unclassified Information (CUI) to build resilient cybersecurity infrastructure following the 110 security controls specified by the National Institute of Technology and Standards Special Publication 800-171 (NIST SP 800-171) by the end of 2017.
“CMMC 2.0 Consultants” are everywhere. Companies claiming to be CMMC 2.0 consultants and expertise in SP 800-171 Rev. 2. Most of these same companies have little to no experience in CMMC 2.0 or even Federal information compliance. They are chasing buzzwords and your hard-earned money.
What is SP 800-171 Rev. 2?
SP 800-171 Rev. 2 is a set of cybersecurity requirements developed by the National Institute of Standards and Technology (NIST) to protect controlled unclassified information (CUI) stored on non-federal information systems. Released in 2020 (updates to January 28, 2021), it aligns with NIST’s Cybersecurity Framework (CSF) and aims to safeguard sensitive information, such as technical data, export-controlled information, or sensitive government information.
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Schedule an initial meeting
Arrange a discovery and assessment call
Tailor a proposal and solution
