Government work is the new and lucrative frontier for IT and cloud providers, and part of its competitiveness is the rigorous requirements for service providers that weed out those who aren’t prepared for such work, leaving effective and professional outfits that can function at a high-level and provide services that other companies can’t. 

While many providers know about standards like FedRAMP or NIST requirements, not many know about CMMC. This relatively new framework impacts IT and cloud providers who want to work with agencies under the Department of Defense (DoD) but provides a clear picture of the requirements these providers must meet to work with sensitive data.

What is CMMC?

The Cybersecurity Maturity Model Certification framework is a standard developed by the Department of Defense to gauge the security capabilities of federal contractors. Specifically, CMMC was developed by the DoD to help protect Controlled Unclassified Information (CUI) and (FCI) handled by these federal contractors. 

CMMC was implemented to protect critical data handled by contractors for the DoD. A recent claim by the DoD notes that contractors handle up to 70% of CUI or FCI, and as such, it is relevant to national security to 

What are CUI and FCI? Controlled Unclassified Information is unclassified information that still requires proper security controls to protect it against unauthorized dissemination. Typically, CUI does not contain proprietary information or intellectual property that calls for additional privacy unless a relationship between a private corporation and a government agency is called for it. 

While CUI is unclassified, it is still important for the operation of a given agency. Hackers will often target CUI because they can gain insight from it in terms of our defense or strike capabilities or other data that could benefit other agencies without the same classified designations. CUI was created as part of an Executive Order signed in November of 2010.

Federal Contract Information is similar to CUI but covers a broad range of documents that are not intended for public release and are specifically part of a contractual relationship between a provider and a government agency.

Currently, the DoD is releasing some RFPs containing CMMC compliance requirements. This trend is expected to increase over time, with it being a 100% requirement for all RFPs by 2026. By that time, government contractors working with DoD must meet CMMC requirements. 

What are the Certification Levels for CMMC?

CMMC derives its language and requirements from existing federal security documents, including NIST 800-171, 48 CFR 52.204-1, and others. 

With those documents, it breaks down areas of concern into domains, capabilities, practices, and processes. 

1. A domain is a broad category covering large impact areas, including items like Access Control and Audit and Accountability. There are 17 domains. 
2. Each domain has a set of capabilities that a contractor must be able to accomplish, including things like  Establishing system access requirements, conducting security awareness activities, or planning an incident response. 
3. Each capability comprises practices and processes linked to that capability that must be in place to protect CUI and FCI. 

Following that, the CMMC certification is broken down into 3 Levels corresponding to the number of domains (and thus capabilities) the contractor must demonstrate to meet that requirement. These levels are:

1. Level 1: Demonstrating the ability to implement “basic” cybersecurity controls from NIST Special Publication 800-171 (15 in total). 
   
2. Level 2: This level is the base minimum where a contractor can handle CUI. At this level, the contractor must implement every control (110 in total). 
   
3. Level 3: Encompassing 134 controls from both NIST SP 800-171 and NIST SP 800-172 and undergo more stringent auditing requirements. This level is for more challenging threats, such as Advanced Persistent Threats (APTs). 

At each level, the responsibilities of the contractor increase in terms of the kinds of security controls they have in place and the additional processes they have to operate those controls across their organization.

What is a C3PAO?

Much like FedRAMP, CMMC calls for a Third-Party Assessment Organization (C3PAO) to handle assessment and audits for the provider. While the assessment process isn’t as prolonged for CMMC as it is for FedRAMP, it is quite involved and is meant to give the government a clear and fair picture of the security capabilities of a provider. 

There are a few terms that might confuse you when looking into C3PAOs, however:

• A 3PAO is an organization certified to audit providers for CMMC compliance.
• A Certified Professional (CP) is a security professional that participates in CMMC assessments, usually as part of a team under an experienced assessor. 
• A Certified Assessor (CA) conducts and manages assessments and supervises CPs.

Both CAs and CPs are part of C3PAO businesses. 

Are There Synergies Between CMMC and FedRAMP?

FedRAMP certification and CMMC are both parts of the federal compliance space. They both utilize several NIST documents as the basis for their compliance demands, but they don’t map onto each other 1-to-1.

FedRAMP regulates government cloud providers by ranking their security requirements low, Medium, and High. These levels are determined by the type of data that a cloud provider would handle with a partner agency. They do not immediately relate to the 3 levels of security outlined in CMMC. 

The DoD has, however, stated that they intend to offer a level of reciprocity between the two so that cloud providers undergoing the rigorous FedRAMP audits (or vice versa with CMMC) have a path to working with agencies in and outside the defense community. For example, a cloud provider handling CUI would call for a Moderate ranking in FedRAMP, which is Level 3 in CMMC. The consensus in some areas is that since these are both relatively the midpoint in their respective frameworks, they could be used as an entry point to map one framework onto the other. 

Conclusion

CMMC is a new and emerging framework that will quickly become a necessity for IT companies and cloud providers who intend to work with agencies under the DoD. More importantly for business, CMMC could open doors for companies who want to expand their potential pool of government agencies within the DoD umbrella. With a potential synergy with FedRAMP, many cloud providers will be able to serve agencies across several levels of the government. 

If you’re interested in learning more about CMMC, FedRAMP, or working with a 3PAO or C3PAO, contact Lazarus Alliance at 1-888-896-7580 or contact us through the form below.