Government work is the new and lucrative frontier for IT and cloud providers, and part of its competitiveness is the rigorous requirements for service providers that weed out those who aren’t prepared for such work, leaving effective and professional outfits that can function at a high-level and provide services that other companies can’t.
While many providers know about standards like FedRAMP or NIST requirements, not many know about CMMC. This relatively new framework impacts IT and cloud providers who want to work with agencies under the Department of Defense (DoD) but provides a clear picture of the necessary requirements these providers must meet to work with sensitive data.
What is CMMC?
The Cybersecurity Maturity Model Certification framework is a standard developed by the Department of Defense to gauge the security capabilities of federal contractors. Specifically, CMMC was developed by the DoD to help protect Controlled Unclassified Information (CUI) and (FCI) handled by these federal contractors.
CMMC was implemented to protect critical data handled by contractors for the DoD. A recent claim by the DoD notes that up to 70% of CUI or FCI is handled by contractors, and as such, it is relevant to national security to
What are CUI and FCI? Controlled Unclassified Information is unclassified information that still requires proper security controls to protect it against unauthorized dissemination. Typically, CUI does not contain any proprietary information or intellectual property that calls for additional privacy unless a relationship between a private corporation and a government agency calls for it.
While CUI is unclassified, it is still important for the operation of a given agency. Hackers will often target CUI because they can gain insight from it, either in terms of our defense or strike capabilities or other data that could benefit other agencies without the same classified designations. CUI was created as part of an Executive Order signed in November of 2010.
Federal Contract Information is similar to CUI but covers a broad range of documents that are not intended for public release and are specifically part of a contractual relationship between a provider and a government agency.
Currently, the DoD is releasing some RFPs that contain requirements for CMMC compliance. This trend is expected to increase over time, with it being a 100% requirement for all RFPs by 2026. This means that by that time, government contractors working with DoD will have to meet CMMC requirements.
What are the Certification Levels for CMMC?
CMMC derives its language and requirements from existing federal security documents, including ones like NIST 800-171, 48 CFR 52.204-1, and others.
With those documents, it breaks down areas of concern into domains, capabilities, practices, and processes.
- A domain is a broad category covering large areas of impact, including items like Access Control and Audit and Accountability. There are 17 domains.
- Each domain has a set of capabilities that a contractor must be able to accomplish, including things like Establishing system access requirements, conducting security awareness activities, or planning an incident response.
- Each capability is composed of practices and processes linked to that capability that must be in place to protect CUI and FCI.
Following that, the CMMC certification is broken down into 5 Levels that correspond to the number of domains (and thus capabilities) that the contractor must demonstrate to meet that requirement. These levels are:
- Level 1: Demonstrating the ability to perform “basic” cyber hygiene practices (17 in total) suitable for protecting FCI. This includes having anti-malware technology in place, password controls, and physical and technical safeguards so employees can protect FCI. This level doesn’t require documentation of those processes.
- Level 2: This level is seen as more of a transition level between Levels 1 and 3. At Level 2, the contractor must demonstrate the ability to perform 72 total practices for “intermediate” hygiene based on NIST 800-171 and other documents. Additionally, these contractors now have to show that they have processes to document their policies and procedures so they can be repeated regularly.
- Level 3: Encompassing 130 practices, level 3 also requires that organizations have processes to plan and manage long-term security implementations, including long-term training and development goals. At this level, contractors are expected to be at “good” cyber hygiene, which emphasizes the storage of CUI.
- Level 4: Level 4 includes 156 practices alongside processes to measure and review performance as well as correct any vulnerabilities. At this level, contractors are also expected to be able to focus on long-term prevention (proactive prevention) of threats through advanced detection capabilities.
- Level 5: At 171 practices, this is considered “advanced” cyber hygiene for sophisticated protection. Processes here are focused on optimizing security controls regularly.
At each level, the responsibilities of the contractor increase both in terms of the kinds of security controls they have in place and in terms of the additional processes they have to operate those controls across their organization.
What is a C3PAO?
Much like FedRAMP, CMMC calls for a Third-Party Assessment Organization (C3PAO) to handle assessment and audits for the provider. While the assessment process isn’t as prolonged for CMMC as it is for FedRAMP, it is quite involved and is meant to give the government a clear and fair picture of the security capabilities of a provider.
There are a few terms that might confuse you when looking into C3PAOs, however:
- A 3PAO is the organization certified to audit providers for CMMC compliance.
- A Certified Professional (CP) is a security professional that participates in CMMC assessments, usually as part of a team under an experienced assessor.
- A Certified Assessor (CA) conducts and manages assessments and supervises CPs.
Both CAs and CPs are part of C3PAO businesses.
Are There Synergies Between CMMC and FedRAMP?
FedRAMP certification and CMMC are both part of the federal compliance space. They both utilize several NIST documents as the basis for their compliance demands, but they don’t map onto each other 1-to-1.
FedRAMP regulates government cloud providers by ranking their security requirements by levels: Low, Medium, and High. These levels are determined by the type of data that a cloud provider would handle with a partner agency, and they do not immediately relate to the 5 levels of security outlined in CMMC.
The DoD has, however, stated that they intend to offer a level of reciprocity between the two so that cloud providers undergoing the rigorous FedRAMP audits (or vice versa with CMMC) have a path to working with agencies in and outside the defense community. For example, a cloud provider handling CUI would call for a Moderate ranking in FedRAMP, which is Level 3 in CMMC. The consensus in some areas is that since these are both relatively the midpoint in their respective frameworks, they could be used as an entry point to map one framework onto the other.
CMMC is a new and emerging framework, but one that will quickly become a necessity for IT companies and cloud providers who intend to work with agencies under the DoD. More importantly for business, CMMC could open doors for companies who want to expand their potential pool of government agencies within the DoD umbrella. With a potential synergy with FedRAMP, many cloud providers are going to be able to serve agencies across several levels of the government.
If you’re interested in learning more about CMMC, FedRAMP, or working with a 3PAO or C3PAO, contact Lazarus Alliance at 1-888-896-7580 or contact us through the form below.