CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC)

Prepare Your Business for CMMC with a Gap Assessment Today

The Cybersecurity Maturity Model Certification (CMMC) represents the latest government effort by the United States Department of Defense (DoD) to adequately secure government data. Government data being utilized and/or developed by vendors with contracts or subcontracts through the U.S. DoD requires some of the best cybersecurity available. This is why the CMMC will soon be required for businesses and manufacturers working with the U.S. DoD.
Several drafts of the CMMC were publically released and public comment was requested. The U.S. DoD took into account public feedback and issued CMMC v1.0 on Jan. 31, 2020. This was updated to v.1.02 on March 18, 2020.

While DFARS 252.204-7012 and NIST SP 800-171 are government regulations that require certain cybersecurity efforts by vendors, the requirements of DFARS 7012 and NIST 800-171 can be completed following the award of a contract and utilizes a self-assessment and attestation process. The new CMMC requires that certain cybersecurity policies, procedures, and controls be implemented prior to the award of a contract as certified by an accredited, independent third-party CMMC assessor.
INQUIRE TODAY!

Dox is now a Registered Provider Organization

Registered Provider Organizations (RPOs) supply advice, consulting, and recommendations to their clients regarding the CMMC standards. Through working with an RPO such as Dox, both primary and secondary contractors can gain insight into the requirements of CMMC from an organization with staff trained in basic CMMC methodology by the CMMC Accreditation Body (CMMC AB). Furthermore, RPO’s are bound by a professional code of conduct while providing targeted CMMC assessment preparation to every client.

Benefits of working with an RPO

There are many benefits to working with an RPO, which is authorized to educate clients regarding the CMMC standard and familiarize them with the basic constructs of the CMMC. By offering consulting services including gap assessments to identify shortcomings in cybersecurity best practices, Dox assists clients in moving toward CMMC accreditation with fewer obstacles.

What this means for manufacturers and other businesses working with the U.S. DoD and for the National Aeronautics and Space Administration (NASA) is that Dox will provide advice and recommendations to aid them in preparing for CMMC certification, which is now required on all DoD and NASA contracts. Additionally, DoD and NASA contracts require a flow-down model in which subcontractors must also achieve CMMC certification.

Frequently Asked Questions

What is cybersecurity maturity model certification?
The Cybersecurity Maturity Model Certification (CMMC) represents the latest government effort by the U.S. DoD and NASA to adequately secure government data. Government data being utilized and/or developed by vendors with contracts or subcontracts through the U.S. DoD and NASA require some of the best cybersecurity available. By achieving those cybersecurity standards, companies ranging from engineering to manufacturing and aerospace are able to achieve CMMC certification in order to qualify for future DoD and NASA contracts.

Who needs CMMC certification?
Any business or organization that contracts with the U.S. DoD or NASA or wishes to do so in the future will be required to achieve CMMC certification. This includes any company that is part of the defense contract supply chain. The DoD estimates the CMMC standards will affect approximately 300,000 companies. Most contracts with the DoD and/or NASA will require a certification between Level 1 and Level 3 to qualify for government contracts.

How is CMMC compliance achieved?
The CMMC is the DoD’s verification mechanism designed to ensure cybersecurity controls and processes adequately protect Controlled Unclassified Information (CUI) that exists on Defense Industrial Base (DIB) systems and networks. CMMC compliance is based on achieving certain hygiene levels (1-5) for your businesses environment.

No longer is compliance reached through a self-attestation process. Now businesses wishing to achieve compliance must do so through a third-party Registered Practitioner (RP). Consulting with an RPO such as Dox first will help you identify cybersecurity shortfalls and suggested remediation to address them prior to working with a RP and CMMC Third-Party Assessor Organization (C3PAO). Taking the initial step to work with Dox before moving on to the RP and C3PAO for CMMC certification can save your company both time and money.

What are the CMMC levels?
The CMMC maps cybersecurity best practices and processes through five maturity levels ranging from basic cyber hygiene at Level 1 to the most secure cyber hygiene at Level 5.

How does my business become CMMC compliant?
The process of achieving CMMC compliance starts with Dox. Our trained experts will perform a pre-assessment of your company’s work environment to provide a gap analysis of CMMC at the specific level you wish to achieve. The pre-assessment is Step 1 in determining what work needs to be done first. Step 2 requires applying the suggested remediation for any security shortfalls. Step 3 is when organizations go through the certified assessment process by a certified auditor from a C3PAO against a certain CMMC Level (1-5).

The CMMC Schedule

CMMC Levels

The CMMC is comprised of five defined cybersecurity levels. Each level has a set of supporting practices and processes. Level one requires the most basic cyber hygiene while level two requires intermediate cyber hygiene. Level three requires compliance with more practices and processes to achieve good cyber hygiene while level four requires a higher, proactive approach to cybersecurity. Level five is the highest level of CMMC and requires the most advanced and progressive practices and processes. There are nine different practices and processes in place for each one of the 17 domains.

CMMC Processes

Processes are also broken into five levels. These also represent maturity level capabilities per domain.

• Level 1: 0
• Level 2: 34 processes
• Level 3: 17 processes (plus L2 processes)
• Level 4: 17 processes (plus L2-L3 processes)
• Level 5: 17 processes (plus L2-L4 processes)