The cybersecurity maturity model certification (CMMC) is a unified framework that is intended to regulate and enforce information security standards across the entire defense supply chain. Unlike with the previous DFARS clause, which is based on the NIST 800-171 framework, self-assessments are no longer enough. Instead, you must engage with a CMMC auditor who has been approved by the CMMC accreditation body (CMMC-AB).
What is a CMMC auditor?
If your business operates in any regulated industry, then you are probably already familiar with auditors. Many businesses use their own auditors to carry out inspections of their technology and operational infrastructures, while others prefer to work with a third party to get an external perspective.
The key distinction of CMMC compliance is that it requires working with an accredited auditor, who will evaluate your cybersecurity posture on behalf of the Department of Defense. Although you can work with other auditors to prepare your business for passing the test, only a CMMC auditor can give you a certification.
#1. Not knowing which CMMC level to aim for
There are five CMMC levels, each one introducing a new set of security standards and controls. Achieving one level requires adherence to all the controls of any previous levels too. The most important decision to make before engaging an accredited CMMC auditor is which level to aim for.
While any business leader wants the best security for their organizations, aiming for Level 5, the highest level, right away might not be practical. Most businesses will want to aim for Level 3 or higher, since this level is required for any organization that handles controlled unclassified information (CUI). Those handling high-value assets (HVAs) may need to be Level 4 or 5.
#2. Not being able to track and identify CUI
You can’t expect to protect what you don’t know, so the most important first step in getting a handle on your organization’s security is being able to track, identify, and classify all assets in your care. CUI is any potentially sensitive information pertaining to the department of defense, such as employee records, personally identifiable data, and intellectual property.
Before you approach a CMMC auditor approved by the CMMC-AB, you must ensure that CUI is contained, isolated, tracked, and controlled. Ensuring that you have complete visibility over all data that falls under your responsibility is essential for demonstrating to any CMMC auditor that your organization adheres to adequate security standards.
#3. Not understanding the role of a C3PAO
During your CMMC journey, you will likely engage with multiple parties, including CMMC third-party assessor organizations (C3PAOs) and registered provider organizations (RPOs). Both of these designations are provided by the CMMC accreditation body and can be found in the CMMC AB Marketplace. However, before you engage either one, it’s important to understand the difference between them.
Most importantly, the only organizations that are able to give you a certification are C3PAOs. To that end, a C3PAO functions as a CMMC auditor, but they cannot provide consultations on the matter due to the need to avoid any potential conflicts of interests. In other words, C3PAOs are independent evaluators whose main job is to evaluate your compliance efforts and assign you a maturity level.
#4. Not engaging an RPO beforehand
Before you engage a C3PAO, you need to ensure you are ready to earn the certification level you’re aiming for. The process should begin with a thorough evaluation of where you currently stand in your security posture. Important first steps include external vulnerability scanning and carrying out a NIST SP 800-171 self-assessment.
Registered provider organizations have been authorized by the CMMC-AB to provide advice, consulting, and recommendations to their clients. To that end, they can help businesses apply the controls and processes necessary to achieve their desired CMMC level, thus preparing them for formal certification by a C3PAO. That’s why it’s highly advisable to engage an RPO before you do anything else. You can find our own listing on the CMMC-AB Marketplace.
Charles IT is ready to help you on your journey towards becoming CMMC-compliant. We offer comprehensive guidance and cutting-edge technology solutions to ensure your business can meet the highest possible security standards. Call us today to schedule a consultation!
