Author: Sese Bennett

The first thing that should be on your radar is to determine what Cybersecurity Maturity Model Certification (“CMMC”) maturity level you are seeking as an organization. If you are storing, processing, or transmitting only Federal Contract Information (“FCI”), then you are likely only seeking CMMC Maturity Level 1 (“ML-1”) certification. If you are storing, processing, or transmitting anything else, then you are most likely seeking Maturity Level 3 (”ML-3”) or above. This is an overly-simplified description of the maturity level designations but hopefully it’s enough to get you going in the right direction.

Now for the good news! If your seeking ML-1, consider that the EZ button of the certification levels. ML-1 certification requires that your organization demonstrate compliance with seventeen (17) CMMC controls and meet a set of basic cyber hygiene requirements. These requirements are focused on validating what you are doing at the time of the assessment. Another way of putting it is that ML-1 is focused on performing the practice versus documenting the practice.  

This means that technically your organization will not fail a ML-1 assessment because of the absence of practice documented. But in reality, you will need to have some sort of documentation available to show that your organization is performing the practice.  Subsequently, it may be acceptable to provide informal or less detailed documentation to the CMMC assessor when reviewing ML-1 controls.  

While we are on the subject of passing or failing, let’s talk about what that means in regards to CMMC.  It should be noted that the CMMC certification is an all-pass or all-fail assessment. This means that you must pass all of the required practices for ML-1 in order to qualify for the certification.  

Now, let’s do a quick breakdown of what those seventeen (17) ML-1 controls are looking for:

The updated CMMC version 1.02 was released by the DoD on March 18, 2020. The CMMC has replaced the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 assessment model which was in place for contractors of the DoD previously.

This new certification requires third party evaluation in order to determine whether a contractor is secure enough to work with the DoD, whereas previously this was up to the contractor. In the past, contractors were responsible for certifying the security of their information technology systems, however this was deemed unacceptable by the DoD.

To stop vulnerabilities and protect the FUI/CUI that contractors may be handling in their work, the DoD has chosen to involve a third party in the certification of contractors.

To make things clear, the DoD has introduced a unified cybersecurity standard for DOD acquisitions which boosts the cybersecurity posture of the Defense Industrial Base (DIB). The certification focuses on various cybersecurity standards and best practices that range from basic cyber hygiene (Level 1) to the more advanced cybersecurity controls (Levels 4 and 5).

The CMMC refers to the Cybersecurity Maturity Model Certification that will replace the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 assessment model currently in place for contractors of the DoD. This new certification will require third party evaluation in order to determine whether a contractor is secure enough to work with the DoD. The CMMC aims to ensure that all contractors dealing with the DoD are able to protect the Controlled Unclassified Information (CUI) that they may be handling in their work.