Overview

• Self-certified compliances is no longer allowed.
• Compliance and Policy creation to meet CMMC standards can be time consuming.
• Not knowing how to navigate the certification process can delay your approval.
• Failure to comply can cause contracts to be released.

CMMC PROCESS

BE COMPLIANT
Enjoy uninterrupted business with the Federal Government and take the stress of this process off your plate.

BENEFIT FROM A MORE SECURE SYSTEM
Align your enterprise practices with this cyber security model and enjoy a strong cyber defensive posture.

STAY AHEAD
Our process helps your organization to be more proactive and not reactive.

DEMONSTRATE COMPLIANCE
Present due diligence and progress in the event of an investigation.

HAVE NO FEAR
Always be prepared for an internal or external audit, armed with current and historical CMMC data.

More Information

One common misconception is that CMMC compliance is the same thing as NIST 800-171. That is not entirely true, especially in the higher levels of CMMC that include requirements from frameworks other than NIST 800-171.

• CMMC Level 1: This is essentially addressing FAR 52.204-21 cyber security principles
• CMMC Level 2: This builds on CMMC Level 1 and address a little over half of NIST 800-171 processes
• CMMC Level 3: This builds on CMMC Level 2 and addresses all NIST 800-171 and a few extras
• CMMC Level 4 & 5: CMMC Levels 4 & 5 build off CMMC Level 3 and includes processes from a range of frameworks:
  • CERT RMM v 1.2
  • NIST 800-53
  • NIST 800-171B
  • ISO 27002
  • CIS CSC 7.1
  • Unattributed "CMMC" references that are not attributed to existing frameworks 

Resources

1. PROCESSES FAMILIES 

2. PROCESSES PER LEVEL

The number of processes needed to achieve certification at each CMMC level.

Based on version 0.7 of the CMMC, there are 5 levels and each has its own specific set of processes that will be in scope for a CMMC audit.

• CMMC Level 1: 17 Processes
• CMMC Level 2: 72 Processes (includes Level 1 controls)
• CMMC Level 3: 131 Processes (includes Level 2 controls)
• CMMC Level 4: 157 Processes (includes Level 3 controls)
• CMMC Level 5: 173 Processes (includes Level 4 controls)

3. REQUIRED DOCUMENTATION

There is approximately 117 policy documents needed for certification. The organization must generate a compliant System Security Plan (SSP) along with proper Plan of Action and Milestone (POA&M) documents.