Level 5 is the highest of all the CMMC levels, and the most time-consuming and complicated to achieve. While this level only adds 15 new CMMC controls, they are far more complex and burdensome to implement and manage than most of those from previous levels. Furthermore, there is the cumulative challenge of implementing all the controls from previous levels for a grand total of 171. In other words, achieving level 5 compliance means your organization will be responsible for the complete implementation and institutionalization of every practice and process covered by the CMMC framework.
Here is a brief overview of what it takes to achieve CMMC level 5:
What is advanced cybersecurity?
CMMC level 5 is a natural evolution from the previous level in that it also addresses far more sophisticated threats like highly targeted social engineering attacks and advanced persistent threats (APTs). The primary goal here is continuous improvement and optimizations. Whereas the previous level lays the foundations for advanced cybersecurity, CMMC level 5 should be considered as an ongoing process that continuously evolves to counter the latest threats. This level will eventually become necessary for any organizations in the Defense Industrial Base (DIB) that work with high-value assets on behalf of the DoD.
Here is an introduction to the new technical practices you need to implement for CMMC level 5:
#1. Access control (AC)
There is only one final AC control introduced in CMMC level 5. This requires identifying and documenting all risks associated with unknown wireless access points that are connected or are attempting to connect to your network.
#2. Audit and accountability (AU)
There is also one last AU control to implement to reach level 5. This concerns the identification of all assets that have lapsed in reporting of audit logs. In other words, if a system fails to keep an audit log up-to-date, the issue must be resolved immediately to maintain complete visibility.
#3. Configuration management (CM)
CM also adds one final control, which concerns the integrity of software critical to security and essential business operations. This includes the formal and indirect verification of roots of trust and authentication measures like cryptographic signatures and multifactor authentication.
#4. Incident response (IR)
IR introduces the largest number of new controls of all the categories covered by CMMC level 5. These are largely focused on proactive security, such as the forensic analysis of potential threats and the maintenance of a highly capable incident response team.
#5. Recovery practice (RE)
There is only one new control introduced in the RE category. CMMC level 5 requires that any and all external information-processing systems used in data recovery also meet your internal security standards. This is especially important if you outsource disaster recovery.
#6. Risk management (RM)
There are two final RM controls you need to implement for CMMC level 5. Firstly, you need to implement an exception process for non-whitelisted software. Secondly, you need to analyze the efficacy of your previously implemented risk-management solutions at least once per year.
#7. System and communication protection (SC)
Three new controls are added for the SC category. These are heavily tied to proactive security, namely the monitoring and recording of all data streams. Boundary protections must also be deployed that align with your organization’s specific needs and technology environment.
#8. System and information integrity (SI)
The two final SI controls cover the detection of potentially suspicious system commands and the regular monitoring and documentation of suspicious behavior. Again, these practices are all about proactive security measures that focus on looking for anomalous activities rather than known threats.
How can organizations achieve total security maturity?
Achieving complete cybersecurity maturity is no easy task, and it may take several years for even a well-resourced organization to reach this level if they are starting from scratch. While there is no such thing as perfect security, CMMC level 5 depends on your ongoing commitment to keeping one step ahead of potential threats. That being said, it is less of a peak than a new beginning – CMMC level 5 is a journey of continuous improvement, whereby the focus lies on protecting against new threats as, and even before, they arise.
Charles IT provides expert guidance and dependable technology solutions to help you achieve your CMMC compliance goals. Call us today to schedule your first assessment!
