With CMMC certification, slow and steady wins the race

Years in the making, the Cybersecurity Maturity Model Certification (CMMC) program is finally starting to take off this summer. However, the program’s current shortage of approved CMMC Third-Party Assessment Organizations (C3PAOs), fluctuating timeline, and pending final form may have some members of your organization wondering when it makes sense to start the CMMC certification. 

The reality is this: If you want to continue doing business with the DoD, you should start taking action and strategizing toward CMMC readiness sooner rather than later. But there’s no need to panic. In fact, the delays with the CMMC program are essentially giving your organization more time to prepare. 

Let’s take a look at what’s going on with the bottleneck of C3PAOs and what steps your organization can take as you await official CMMC certification.

What’s the Situation with C3PAOs?

The current pace of C3PAO authorization has many experts in the federal compliance space predicting that the original rollout schedule may get delayed by as much as a year. In fact, there are hundreds of organizations vying for their C3PAO approved status and thousands of contractors waiting to achieve CMMC certification, yet only a select few organizations have been granted approved C3PAO status so far. This is largely because the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) has been methodical in their testing of potential auditors. 

If your organization has already started preparing for CMMC certification by pursuing a readiness assessment or seeking to improve your score for NIST 800-171 (upon which much of CMMC is based), a delay won’t undo the work you’ve already completed. 

On the other hand, if your organization hasn’t begun to lay the groundwork for CMMC certification, now is the time to get the ball rolling. Here are three steps you can take to start getting ready. 

1. Evaluate Your Data

CMMC chiefly focuses on the protection of controlled unclassified information (CUI). CUI includes a range of different data types, including software code, engineering drawings, tax-related information, intellectual property, and much more. It is important for your organization to identify the data you handle that falls under this category because it will be subject to CMMC. 

A crucial distinction between CMMC and other cybersecurity frameworks is that CMMC was designed to protect data in non-federal IT systems; in other words, information within your IT systems that isn’t classified but can be considered sensitive or confidential. 

Worth noting is that it’s possible your organization may already have a federal compliance certification, such as FedRAMP or FISMA, that results in your systems (or portions of them) being classified as “federal”. But even if that’s the case, your organization can still have CUI that is subject to CMMC. For example, you could generate derived CUI that is created based on how your organization works with federal data, or you might process designated CUI in systems that don’t fall under FedRAMP or FISMA. 

2. Self-assess Against NIST 800-171

As mentioned above, CMMC is largely based upon NIST 800-171, the original requirements designed to help contractors protect CUI. The 110 controls included in NIST 800-171 cover CMMC Levels 1 - 2, Level 3 has 20 additional controls, and Levels 4 and 5 have 156 and 171 controls, respectively.

As you are likely aware, the Defense Federal Acquisition Regulation Supplement (DFARS) Interim Rule that took effect in November 2020 requires all defense contractors that handle CUI to complete a NIST 800-171 self-assessment and submit their score to the DoD’s Supplier Performance Risk System (SPRS) for approval. However, before the Interim Rule, this system hasn’t been rigorously enforced — something the C3PAO aspect of CMMC aims to remedy.

If it’s been a while since your organization conducted a self-assessment, or if your last assessment wasn’t very thorough, I recommend you refer to the official NIST handbook or reach out to your third-party assessor to help you generate and understand your current NIST 800-171 assessment score.

3. Prepare your subcontractors

In 2019, former Under Secretary for Defense Acquisition and Sustainment Ellen Lord remarked that vulnerabilities in the DoD supply chain are most pervasive “six to seven levels down” from prime contractors. If you are a prime contractor, be aware that you are required to downwardly communicate the proper CMMC requirements to your subcontractors. 

As you gain a better understanding about what CUI is and where it’s located within your systems, you should educate your subcontractors about this topic so they, too, may begin to prepare for CMMC certification. 

Set Up Your Organization for CMMC Success

Since the majority of potential C3PAOs are still awaiting authorization and some parts of the CMMC model will likely change in the coming months, don’t be too concerned that your organization may not receive certification this year. Instead, start taking steps to assess your own cybersecurity maturity in order to identify areas for improvement. This will help put you ahead of the curve when it comes time to obtain official CMMC certification. 

With CMMC, slow and steady wins the race: Being thoughtful, yet proactive, about improving your organization’s cybersecurity strategy will put you on a smoother, more stress-free path to certification.