WORLD CLASS CMMC SERVICES 

In 2020 the DoD released The Cyber Security Maturity Model Certification (CMMC). The intent is to reduce unauthorized disclosure of Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

The CMMC framework consists of 3 levels, each with specific controls and objectives. Level 3, the most advanced level, will only be a requirement for several hundred contractors. However, those required to meet compliance with Level 2, will impact tens of thousands of contractors. Level 2 is focused on organizations interacting with Controlled Unclassified Information (CUI). These organizations will have to prove that they have met the security controls, and the hundreds of Cyber Security Assessment Objectives as part of the requirement. Most DoD contractors will need to pass a 3rd party Assessment (Audit) validating Level 2 compliance, which will be reported to the DOD, and be required for DoD contract eligibility. 

This effort is defined in DFARS 252.204-7019-7021, and its requirements will impact 300,000+ DoD contractors. Almost all DoD contractors that have, or handle CUI, must become CMMC Level 2 certified. Unlike DFARS, which requires a self-assessment score submitted annually, CMMC does not offer the option to self-certify, for Level 2 or 3. Level two requires a passing score as attested by a C3PAO, third party assessor. Level 3 requires a passing score as attested by DIBCAC every 3 years. While Level 1 only requires a self-assessment, the DoD is conducting spot checks and issuing significant fines for fraud if a self-assessment proves to be false.

Failure to meet any CMMC qualifications will put the contractor at risk for significant fines, attached to false claims, and ultimately will eliminate the business from receiving PO’s, Contract Awards, and overall eligibility to work with the DoD.

As mentioned previously, CMMC is defined in DFARS 252.204-7019-7021, and will require that all DoD contractors that handle CUI become CMMC Level 2 compliant and most (96%) must pass a 3rd party assessment (audit).

CMMC is based on the NIST 800-171 rev 2.0 standard, soon to be rev 3.0. Within the Level 2 CMMC framework, there are 14 control families, which consist of 110 specific controls, and 320 Assessment Objectives. All objectives within a control must be met to comply with that specific control requirement.

The 14 control families include: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Security Assessment and Authorization (CA), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Physical and Environment Protection (PE), Personnel Security (PS), Risk Assessment (RA), Systems and Communication Protection (SC), Systems and Information Integrity (SI) 

In general, the contractor must meet these controls, and must Document, Perform, and Manage the practices within these controls. Required documentation will include Procedures and Control Documents, POA&M’s, and a System Security Plan (SSP).

To access the NIST 800-171 Standard, and the DoD CMMC documentation Library documents, please click on relevant buttons below.

Bulletproof's Mission is Helping You Achieve the Ideal Business Outcome

• When aiming to successfully undergo a Level 2 Cybersecurity Maturity Model Certification (CMMC) assessment, defense contractors may find themselves wanting to delay the pain, and in some cases ignore the inevitable. Looking at the need to address 320 assessment objectives spread across 110 controls and 14 control families, achievement can feel overwhelmingly complex, if not unattainable.

• Bulletproof's innovative services and solutions take the pain away. Our experts, and world-class methodologies, guide DoD contractors through a seamless and phased implementation of CMMC quickly and confidently.

• Our portfolio of solutions is purpose-built for SMB DoD contractors. To help you build your compliance program, we offer CMMC and Cyber consulting services as well as Managed Services to protect your infrastructure and to support your journey to meeting and maintaining CMMC compliance standards.